e107: SQL injection in alt_auth login via external database backends
Summary
e107 is a PHP content management system. Prior to version 2.3.7, the bundled alt_auth plugin's otherdb and e107db login backends insert the submitted username directly into SQL queries. An unauthenticated attacker can exploit this when alt_auth is installed and one of these backends is connected to a live external database. Successful exploitation can expose or modify data accessible to the configured database account, and query errors can reveal the generated SQL.
Affected
- e107 versions prior to 2.3.7 (CNA record: affected < 2.3.7)
- Exploitation requires the alt_auth plugin with the otherdb or e107db backend configured against a live external database
- Some sources report a lower bound of 2.3.0; treat all releases before 2.3.7 as affected
Fixed in
- Fixed in e107 2.3.7 (vendor advisory GHSA-5f75-c25x-59wx)
- The 2.3.7 release notes describe a wider SQL injection fix across the e107 core; the vendor states that no configuration setting mitigates unpatched sites
- Later releases (2.3.8 and newer) include further SQL injection hardening; the newest release should be verified on GitHub
Workaround
- Disable the alt_auth plugin, or at least the otherdb and e107db backends, until the upgrade is complete
- Restrict the external database account to least privilege
- Do not display database error messages to visitors
- The vendor has published no other workaround
Exploitation
- No known exploitation in the wild at the time of research
- No public proof of concept found in the sources reviewed
- CISA SSVC: exploitation none, automatable yes, technical impact total
- EPSS is low (about 0.5 percent according to one aggregator)
Our recommendation
- Inventory all e107 installations, including any still on 2.3.7 or older
- Upgrade to the current e107 release as soon as possible
- Check whether alt_auth with an external database backend is enabled and disable it if it is not required
- Review web server and database logs for unusual login requests
- Restrict database account permissions and suppress database error output on public sites
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor advisory GHSA-5f75-c25x-59wx github.com
- Fix commit 120bd4bd github.com
- e107 v2.3.7 release github.com
- e107 v2.3.8 release github.com
- OSV entry CVE-2026-55572 osv.dev
- VulDB entry 420284 vuldb.com
- Strix CVE summary www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:14.
Original description (NVD)
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.