External risk intelligence

e107 SQL Injection Vulnerability Allows Arbitrary SQL Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72599

The vulnerability affects a content management system's news page, which is a public-facing web component by design. Because it allows unauthenticated interaction with a core page parameter, the vulnerable surface is directly reachable via the public internet in normal deployments.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a flaw in how certain web content management systems handle data. An attacker could potentially exploit this to access, alter, or remove information stored in the system's database, which might include sensitive details.

Flaw allows attackers to misuse database functions.
Matters due to potential for broad data compromise.
Confirm relevance and exposure in your systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a website using the affected software. The request targets the news item page, where a parameter is used directly in a database query without proper sanitization. This allows the attacker to inject malicious SQL commands, potentially leading to unauthorized access and manipulation of the website's database.

No authentication is needed.
Crafted request targets news page parameter.
Allows database compromise.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability could allow an unauthenticated remote attacker to read, modify, or delete all database contents, including administrator credentials, when they interact with the news item page ID parameter.

Database contents, including admin credentials.
Via the news item page ID parameter.
Unauthorized database access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the e107 content management system, specifically its news item functionality. Application owners, platform teams, and potentially network or security teams are responsible for addressing this. The first practical step is to identify all instances of e107, confirm their internet reachability and business criticality, and then determine the accountable owner for remediation planning.

Application owners must own this issue.
Verify internet-facing e107 instances.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is e107?

e107 is a content management system used to build and manage websites. It provides a framework for site administrators to publish content, such as news articles, and manage user interactions. It relies on a database to store site information, including user accounts, site configurations, and published content.

What does CVE-2026-72599 mean for the database?

This vulnerability is an SQL injection, classified as CWE-89. It happens when the software takes user-supplied data and inserts it directly into database commands without checking it first. Because of this flaw in the news page, an attacker can manipulate these commands to view, change, or erase any data stored in your database, including sensitive administrator credentials.

How is this vulnerability triggered?

An attacker triggers this by sending a specifically crafted network request to the website's news item page. The malicious code is hidden within the page ID parameter. It is important to note that simply visiting the site or browsing the news section normally does not trigger the bug; it requires a deliberate, crafted request designed to inject SQL commands.

Is my e107 instance at risk?

According to Halo Surface Signal, this vulnerability is very likely to be reachable if your instance is internet-facing. Because the flaw exists in a core news page component that is public by design, external attackers can reach this parameter without needing any prior authentication or special access to your internal network.

How should I respond to this vulnerability?

Begin by creating a complete inventory of your e107 installations. Focus your attention on identifying which instances are accessible via the public internet, as these represent the most immediate risk. Once identified, assign ownership of these instances to the relevant application teams to plan and track the necessary updates or security mitigations.

References

github.com/e107inc/e107

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.