CVE-2018-15901

The CVE-2018-15901 entry concerns e107 2.1.8, where a CSRF flaw in usersettings.php allows altering user details, including administrator passwords. The vulnerability’s root cause is improper CSRF protection in the usersettings.php workflow, enabling unauthorized changes without user interaction....

CVE-2018-15901: Cross-Site Request Forgery (CSRF)

e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators...

e107 CMS 2.1.2 Privilege Escalation

Exploit Title: e107 CMS 2.1.2 Privilege Escalation Date: 09-11-2016 Software Link: http://e107.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Datas from $POST'updateddata' inside usersettings.php are...

e107 CMS 2.1.2 Privilege Escalation Vulnerability

Exploit for php platform in category web applications Exploit Title: e107 CMS 2.1.2 Privilege Escalation Date: 09-11-2016 Software Link: http://e107.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Dat...

CVE-2015-1057

Cross-site scripting XSS vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" value...

CVE-2015-1057

The vulnerability CVE-2015-1057 is an XSS issue in e107 2.0.0, affecting usersettings.php. The flaw allows remote attackers to inject arbitrary web script or HTML via the Real Name field, enabling possible script execution in the user’s context. The connected sources confirm the affected product/...

CVE-2015-1057: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" value...

e107 'usersettings.php' Cross-Site Scripting Vulnerability

E107 is an open source, free and based on PHP and MySQL content management system CMS of the United States E107 company. The system supports a variety of plug-in programs and appearance of the theme , can be used as a personal blog , discussion community , archive repository and so on. A cross-si...

CVE-2011-4448: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to execute arbitrary SQL commands via the defaultcommentdisplay parameter in an update action...

Sql injection

SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2011-4921

The CVE-2011-4921 entry describes a SQL injection in e107:9 usersettings.php affecting e107 0.7.26 and possibly earlier versions before 1.0.0. The flaw allows remote attackers to execute arbitrary SQL commands via the username parameter. Connected sources corroborate the vulnerability but do not ...

CVE-2011-4921: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2010-2098

Incomplete blacklist vulnerability in usersettings.php in e107 0.7.20 and earlier allows remote attackers to conduct SQL injection attacks via the loginname parameter...

CVE-2010-2098

CVE-2010-2098 affects the e107 CMS, specifically versions 0.7.20 and earlier, where an incomplete blacklist in usersettings.php enables remote SQL injection via the loginname parameter. The vulnerability can impact confidentiality, integrity, and availability as indicated by the CVSS v2 base scor...

CVE-2010-2098: Undefined Security Weakness

Incomplete blacklist vulnerability in usersettings.php in e107 0.7.20 and earlier allows remote attackers to conduct SQL injection attacks via the loginname parameter...

Sql injection

SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320...

CVE-2009-1409

SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320...

CVE-2009-1409: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320...

e107 < 0.7.15 - 'extended_user_fields' Blind SQL Injection

!/usr/bin/env perl e107 dbUpdate"userextended", $uefields." WHERE userextendedid = '".intval$inp."'"; ue POST variable needs a valid key such as "aim","msn" or other userextendedfields @fields array. Fix this sql injection using php function mysqlrealescapestring to the POST 'hide' key, otherwise...

Geeklog usersettings.php模块SQL注入漏洞

BUGTRAQ ID: 34553 Geeklog是一个免费的、开放源码的Web应用程序。它可以使用户创建一个虚拟的社区，可以管理用户，张贴文章等。Geeklog采用PHP实现，以MySQL为后台数据库。 Geeklog的usersettings.php文件中的1467 - 1480行中存在SQL注入漏洞： ... if isset $USER'uid' && $USER'uid' 1 switch $mode case 'saveuser': savepreferences $POST; $display .= saveuser$POST; PLGprofileExtrasSave ;...