Description

e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.

Remediation

References

CVE-2016-10753

Related Vulnerabilities

Handlebars Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-20920)

Ampache Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2008-3929)

WordPress Plugin Popup Builder-Create highly converting, mobile friendly marketing popups Cross-Site Scripting (4.2.7)

MySQL CVE-2020-14773 Vulnerability (CVE-2020-14773)

WordPress Plugin Custom Post Type Relations Cross-Site Scripting (1.0)

Severity

High

Classification

CVE-2016-10753 CWE-502 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities