Description
The cross-site request forgery (CSRF) protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date of the administrator account, which allows remote attackers to hijack the authentication of administrators for requests that add new users via e107_admin/users.php.
Remediation
References
Related Vulnerabilities
WordPress Plugin Ultimate FAQ Cross-Site Scripting (1.8.29)
Chamilo Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-33702)
SharePoint CVE-2021-43876 Vulnerability (CVE-2021-43876)
WordPress Plugin WP Customer Reviews Cross-Site Scripting (3.4.2)
Jboss EAP Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-9518)