The alt_auth plugin of the e107 CMS contains an SQL injection flaw in its otherdb and e107db authentication backends where the login username field is interpolated directly into an SQL statement without prior sanitization. Before the plugin performs effective data validation, the username string is passed to PDO::query(), allowing an unauthenticated user to inject arbitrary SQL. The injected query can read, modify, or delete data accessible to the configured external database account, and query failures can leak the generated SQL through debug output, further exposing internal details.

Installations of e107 CMS version 2.3.6 or earlier with the alt_auth plugin enabled and configured to use the external otherdb or e107db authentication backends are affected. Version 2.3.7 and later remove the vulnerable code. The affected product is the e107 CMS from e107inc.

The vulnerability has a CVSS score of 10, indicating critical severity. The EPSS score is <1%, suggesting low observed exploitation probability, yet the lack of access restrictions allows attackers to craft malicious login requests from any remote host. The flaw is not listed in the CISA KEV catalog. An attacker only needs to submit a crafted username to the login endpoint to execute SQL commands against the configured database, potentially compromising confidentiality, integrity, and availability of the site.