Reflected Cross-Site Scripting (XSS) in e107 CMS

Finding

The vulnerability was discovered during manual code review and request/response testing of publicly accessible front-end controllers in e107 CMS. Multiple scripts were found to reflect user-supplied HTTP GET and POST parameters directly into HTML responses without consistent output encoding.

Reproducibility

An unauthenticated attacker can send a crafted HTTP GET or POST request containing malicious JavaScript payloads to affected endpoints such as search.php, news.php, or user.php. When the server responds, the payload is reflected in the rendered HTML and executed in the victim’s browser.

Impact

This is a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79). Any user who visits a maliciously crafted URL is impacted. Successful exploitation allows client-side JavaScript execution in the victim’s browser context, enabling information disclosure, session hijacking, and potential privilege escalation.

Patches

No official patch or security advisory has been released by the vendor at the time of writing. Affected users should monitor upstream changes to the e107 CMS repository and upgrade to a version newer than 2.3.3 once a fix is available.

Workarounds

Administrators may apply custom patches by ensuring all user-controlled output is properly encoded using functions such as htmlspecialchars() before rendering. Web application firewalls (WAFs) may also be configured to block reflected script injection patterns.

References

https://github.com/e107inc/e107