CVE-2026-55572

e107 CMS versions before 2.3.7 contain an unauthenticated SQL injection in the bundled alt_auth plugin. When the otherdb or e107db authentication backend is configured with a live external database, the login() methods in otherdb_auth.php and e107db_auth.php place the submitted username directly into SQL and run it with PDO::query() before effective sanitization. An attacker who can reach the login page can read or change data available to the configured database account, and failed queries can leak the generated SQL through the debug-message path. Only sites that have alt_auth installed and one of those backends actively connected are affected. There is no known public proof of concept and the issue is not listed in CISA KEV; it is fixed in 2.3.7.

What to do: Upgrade e107 to version 2.3.7 or later. Until then, disable the alt_auth plugin or stop using the otherdb and e107db backends with a live external database, and review database and application logs for unexpected login-time SQL errors or debug messages that echo queries.