Php Content Management System e107 multiple cross-site scripting and SQL Injection Vulnerabilities

Affected Versions:
E107 website system 0.7.16 vulnerability description:

E107 is a content management system written in php.

The following modules of e107 do not fully filter user submitted variables:

-Submitnews. php
-Usersettings. php.
-E107_admin/newpost. php.
-E107_admin/banlist. php.
-E107_admin/banner. php.
-E107_admin/cpage. php
-E107_admin/download. php.
-E107_admin/users_extended.php.
-E107_admin/frontpage. php.
-E107_admin/links. php.
-E107_admin/mailout. php.

Remote attackers can execute cross-site scripting attacks by submitting malicious requests. When you log on to e107 and click these links, the injected code is executed in the browser session.

The Search function of e107 has the SQL blind injection vulnerability. Remote attackers can completely intrude into the database by submitting malicious query requests. <* Reference
Do Hoang Bach


--------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version: