e107 CMS alt_auth Plugin SQL Injection Vulnerability

e107, a content management system, is affected by a SQL injection vulnerability in its bundled alt_auth plugin before version 2.3.7.

The otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization.

• An unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection.
• The injection can expose or modify data available to the configured database account.
• Query failures can additionally disclose the generated query through the debug-message path.
• This issue is fixed in version 2.3.7.