Quantum Secular Labs / Blog / Advisories
CVE-2026-55572: Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the…
CVE-2026-55572 is rated critical with a CVSS v3.1 base score of 10.0. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.
Vulnerability description
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.
Severity breakdown
CVSS v3.1 10.0: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
- Attack complexity: Low. No special conditions; the attack can be repeated reliably.
- Privileges required: None. No account or prior access is needed.
- User interaction: None. No action from any user is needed.
- Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
- Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
- Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
- Availability impact: High. Total loss of availability; the component can be shut down.
Underlying weakness
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.