Unscored severity · published Dec 14, 2005
CVE-2005-4224
Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via (1) the email, hideemail, image, realname,…
–
CVSS
1.7%
EPSS
No
On KEV
Description
Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via (1) the email, hideemail, image, realname, signature, timezone, and xupexist parameters in signup.php, (2) the content_comment, content_rating, and content_summary parameters in subcontent.php, (3) the download_category and file_demo in upload.php, and (4) the email, hideemail, user_timezone, and user_xup parameters in usersettings.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E1
E107 · E107
0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4224
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4224
glide.stanford.edu
http://glide.stanford.edu/yichen/research/sec.pdf
Vendor Advisory
http://secunia.com/advisories/18023/
www.osvdb.org
http://www.osvdb.org/21657
www.osvdb.org
http://www.osvdb.org/21658
www.osvdb.org
http://www.osvdb.org/21659
www.osvdb.org
http://www.osvdb.org/21660
More from E107
9.8
CVE-2026-72599
e107 e107 - SQL Injection
8.8
CVE-2021-27885
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism
8.8
CVE-2016-10753
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC
8.8
CVE-2018-15901
e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators
8.1
CVE-2025-11941
e107 CMS Avatar image.php path traversal