e107 CMS Installer PHP Object Injection RCE Vulnerability

e107, a content management system (CMS), contains a PHP object injection vulnerability in its installer.

Prior to version 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation.

A crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable.

• An unauthenticated attacker who can reach install.php can execute arbitrary PHP functions with the web server process's privileges.
• This can lead to full server compromise.
• The issue is fixed in version 2.3.7.