Secunia

SmOk3 has reported a vulnerability in e107, which can be exploited to conduct script insertion attacks.

The vulnerability is caused due to missing input validation in "news submit" and "article submit". The problem is that arbitrary HTML and script code can be included in "login name/author", which will be executed in a user's browser session in context of a vulnerable site when a malicious article or news posting is viewed.

Successful exploitation requires that the malicious person is logged in as a guest user.

The vulnerability reportedly affects version 0.614 and prior.

Solution
The vulnerability has reportedly been fixed in version 0.615.
Further details available in Customer Area

Provided and/or discovered by
SmOk3

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area