CVE-2026-55572: e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username
e107 is a content management system (CMS). Prior to 2.3.7, the bundled altauth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107plugins/altauth/otherdbauth.php and e107plugins/altauth/e107dbauth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when altauth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
e107to a version that resolves this vulnerability.Fixed in 2.3.7
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Deployments prior to 2.3.7 are exposed if the bundled alt_auth plugin is installed and either the otherdb or e107db backend is configured with a live external database connection. The attacker does not need an account or user interaction; they only need to submit a crafted login username.
Is this affected by the default authentication configuration?
The issue is limited to the alt_auth plugin's otherdb and e107db backends. The provided information does not indicate that installations using other authentication backends are affected.
What is the immediate mitigation if upgrading is not possible?
Disable the affected alt_auth backend or remove its live external database connection until the instance can be updated. This prevents the vulnerable login methods from querying the external database with an attacker-controlled username.
What could indicate attempted exploitation or information disclosure?
Review login-related failures and debug-message output for generated SQL queries, since query failures can disclose the constructed query through the debug-message path. Also investigate unexpected database reads or modifications performed by the account configured for the external authentication database.
What version contains the fix?
The issue is fixed in e107 version 2.3.7. Upgrade affected deployments to that version or later.