https://vulnerability.circl.lu/sightings/feed 2026-07-27T19:14:13.888591+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/af5a3d09-fffc-4c00-a705-8c382164c912/export 2026-07-27T19:14:13.900505+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "af5a3d09-fffc-4c00-a705-8c382164c912", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57859", "type": "seen", "source": "https://gist.github.com/sermikr0/6f68b5bcfc1024269f1cd032abb55a0f", "content": "# CVE-2026-57859 \u2014 e107 CMS: Second-Order Persistent RCE via `eval()` in Legacy `user_prefs` Deserialization\n\n**Severity:** HIGH (CVSS 8.1) \n**CWE:** CWE-94 \u2014 Code Injection \n**Affected:** e107 CMS v2.3.x (all current versions) \n**Status:** \u26a0\ufe0f Unpatched \u2014 Vendor notified via VulnCheck CVD (2026-07-17) \n**CVE ID:** CVE-2026-57859 (allocated by VulnCheck)\n\n---\n\n## Summary\n\ne107's `e107::unserialize()` function contains a legacy deserialization path in `e107_handlers/core_functions.php` that passes database-stored content directly into PHP's `eval()`. Any value in the `user_prefs` database column that begins with the string `array` is evaluated as PHP code on every user login. An attacker who can write to `user_prefs` (via SQL injection, IDOR, or direct DB access in a multi-tenant scenario) achieves persistent Remote Code Execution without writing a PHP file.\n\n---\n\n## Vulnerable Code\n\n**File:** `e107_handlers/core_functions.php` \u2014 lines 651\u2013657\n\n```php\n$ArrayData = trim($ArrayData);\n\n// Only guard: value must begin with 'array' (case-insensitive)\nif (stripos($ArrayData, 'array') !== 0) {\n return false;\n}\n\n// Vulnerable: user-controlled $ArrayData passed directly to eval()\n$ArrayData = '$data = ' . $ArrayData . ';';\ntry {\n @eval($ArrayData); // \u2190 SINK: arbitrary PHP code execution\n} catch (ParseError $e) {\n ...\n}\n```\n\nThe guard `stripos($ArrayData, 'array') !== 0` only checks that the value **starts with** `array`. Any PHP expression valid as an array element \u2014 including function calls like `system()`, `passthru()`, `file_put_contents()` \u2014 passes this check.\n\n---\n\n## Call Chain (Triggered on Login)\n\n```\nHTTP POST /e107_web/index.php (login request)\n \u2514\u2500 e107_handlers/login.php:472\n \u2514\u2500 e107::getArrayStorage()->unserialize($userData['user_prefs'])\n \u2514\u2500 e107_handlers/core_functions.php:651 \u2014 legacy branch\n \u2514\u2500 @eval('$data = ' . $user_prefs . ';')\n \u2514\u2500 ARBITRARY CODE EXECUTES as web server user\n```\n\nThe payload is **persistent**: once stored in `user_prefs`, it executes on **every subsequent login** for that user account.\n\n---\n\n## Attack Scenario\n\n**Prerequisite:** Write access to the `user_prefs` column (via SQL injection elsewhere in e107, IDOR, or admin-level access in a compromised environment).\n\n**Payload stored in `user_prefs`:**\n```\narray(0 => system('id'))\n```\n\n**What eval() executes:**\n```php\n$data = array(0 => system('id'));\n```\n\n**Result:** `system('id')` executes server-side, returning `uid=33(www-data)`.\n\n**Why this is second-order:** The payload is written to the database in one request and triggered on a later, unrelated login request \u2014 bypassing any input filtering on the login endpoint itself.\n\n---\n\n## Impact\n\n- Remote Code Execution as the web server process user (`www-data`)\n- Payload persists across sessions (stored in DB)\n- No PHP file write required \u2014 evades file-integrity monitoring\n- Triggers silently on every login \u2014 no user interaction visible\n- Chains with any SQLi vulnerability in e107 to form a complete unauthenticated RCE path\n\n---\n\n## Proof of Concept\n\n*Tested on e107 v2.3.x (Docker, local environment)*\n\n```bash\n# Step 1: Store payload in user_prefs via SQL injection or DB access\n# (payload passes the 'array' prefix guard)\n# Stored value: array(0 => file_put_contents('/tmp/pwned.txt', posix_getlogin()))\n\n# Step 2: Trigger by logging in as the affected user\n# On login, core_functions.php:657 evals the stored payload\n\n# Step 3: Verify\ncat /tmp/pwned.txt\n# Output: www-data\n```\n\nBlind execution confirmed \u2014 output visible via file write side-channel, not in HTTP response.\n\n---\n\n## Fix Recommendation\n\nReplace `eval()` with a safe deserializer. e107 already uses `json_encode`/`json_decode` in newer code paths \u2014 the legacy `eval()` branch should be removed entirely:\n\n```php\n// BEFORE (vulnerable):\n$ArrayData = '$data = ' . $ArrayData . ';';\n@eval($ArrayData);\n\n// AFTER (safe):\n// Remove the eval() branch entirely.\n// Use json_decode() for all user_prefs values.\n// Migrate existing eval-format rows during upgrade.\n```\n\nAlternatively, add strict allowlisting so only known-safe array keys/values are accepted \u2014 but removing `eval()` entirely is the only safe fix.\n\n---\n\n## Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-07-14 | Vulnerability discovered and verified on local Docker instance |\n| 2026-07-17 | Submitted to VulnCheck CVD |\n| 2026-07-17 | CVE-2026-57859 provisionally allocated by VulnCheck |\n| 2026-07-17 | VulnCheck initiated outreach to e107 vendor |\n| 2026-11-14 | 120-day disclosure deadline |\n\n---\n\n## References\n\n- [e107 GitHub Repository](https://github.com/e107inc/e107)\n- [Vulnerable file: core_functions.php](https://github.com/e107inc/e107/blob/master/e107_handlers/core_functions.php)\n- [CWE-94: Improper Control of Generation of Code](https://cwe.mitre.org/data/definitions/94.html)\n- [CVSS 3.1 Vector: AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\n---\n\n*Discovered by: Saidakbarxon Maxsudxonov (@sermikroo)* \n*Coordinated disclosure via VulnCheck CVD Program*", "creation_timestamp": "2026-07-21T00:00:00.001838Z"} 2026-07-21T00:00:00.001838+00:00 https://vulnerability.circl.lu/sighting/61a4d90d-5ed2-4146-a81d-58473b8c4721/export 2026-07-27T19:14:13.901778+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "61a4d90d-5ed2-4146-a81d-58473b8c4721", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57859", "type": "seen", "source": "https://gist.github.com/sermikr0/6f68b5bcfc1024269f1cd032abb55a0f", "content": "# CVE-2026-57859 \u2014 e107 CMS: Second-Order Persistent RCE via `eval()` in Legacy `user_prefs` Deserialization\n\n**Severity:** HIGH (CVSS 8.1) \n**CWE:** CWE-94 \u2014 Code Injection \n**Affected:** e107 CMS v2.3.x (all current versions) \n**Status:** \u26a0\ufe0f Unpatched \u2014 Vendor notified via VulnCheck CVD (2026-07-17) \n**CVE ID:** CVE-2026-57859 (allocated by VulnCheck)\n\n---\n\n## Summary\n\ne107's `e107::unserialize()` function contains a legacy deserialization path in `e107_handlers/core_functions.php` that passes database-stored content directly into PHP's `eval()`. Any value in the `user_prefs` database column that begins with the string `array` is evaluated as PHP code on every user login. An attacker who can write to `user_prefs` (via SQL injection, IDOR, or direct DB access in a multi-tenant scenario) achieves persistent Remote Code Execution without writing a PHP file.\n\n---\n\n## Vulnerable Code\n\n**File:** `e107_handlers/core_functions.php` \u2014 lines 651\u2013657\n\n```php\n$ArrayData = trim($ArrayData);\n\n// Only guard: value must begin with 'array' (case-insensitive)\nif (stripos($ArrayData, 'array') !== 0) {\n return false;\n}\n\n// Vulnerable: user-controlled $ArrayData passed directly to eval()\n$ArrayData = '$data = ' . $ArrayData . ';';\ntry {\n @eval($ArrayData); // \u2190 SINK: arbitrary PHP code execution\n} catch (ParseError $e) {\n ...\n}\n```\n\nThe guard `stripos($ArrayData, 'array') !== 0` only checks that the value **starts with** `array`. Any PHP expression valid as an array element \u2014 including function calls like `system()`, `passthru()`, `file_put_contents()` \u2014 passes this check.\n\n---\n\n## Call Chain (Triggered on Login)\n\n```\nHTTP POST /e107_web/index.php (login request)\n \u2514\u2500 e107_handlers/login.php:472\n \u2514\u2500 e107::getArrayStorage()->unserialize($userData['user_prefs'])\n \u2514\u2500 e107_handlers/core_functions.php:651 \u2014 legacy branch\n \u2514\u2500 @eval('$data = ' . $user_prefs . ';')\n \u2514\u2500 ARBITRARY CODE EXECUTES as web server user\n```\n\nThe payload is **persistent**: once stored in `user_prefs`, it executes on **every subsequent login** for that user account.\n\n---\n\n## Attack Scenario\n\n**Prerequisite:** Write access to the `user_prefs` column (via SQL injection elsewhere in e107, IDOR, or admin-level access in a compromised environment).\n\n**Payload stored in `user_prefs`:**\n```\narray(0 => system('id'))\n```\n\n**What eval() executes:**\n```php\n$data = array(0 => system('id'));\n```\n\n**Result:** `system('id')` executes server-side, returning `uid=33(www-data)`.\n\n**Why this is second-order:** The payload is written to the database in one request and triggered on a later, unrelated login request \u2014 bypassing any input filtering on the login endpoint itself.\n\n---\n\n## Impact\n\n- Remote Code Execution as the web server process user (`www-data`)\n- Payload persists across sessions (stored in DB)\n- No PHP file write required \u2014 evades file-integrity monitoring\n- Triggers silently on every login \u2014 no user interaction visible\n- Chains with any SQLi vulnerability in e107 to form a complete unauthenticated RCE path\n\n---\n\n## Proof of Concept\n\n*Tested on e107 v2.3.x (Docker, local environment)*\n\n```bash\n# Step 1: Store payload in user_prefs via SQL injection or DB access\n# (payload passes the 'array' prefix guard)\n# Stored value: array(0 => file_put_contents('/tmp/pwned.txt', posix_getlogin()))\n\n# Step 2: Trigger by logging in as the affected user\n# On login, core_functions.php:657 evals the stored payload\n\n# Step 3: Verify\ncat /tmp/pwned.txt\n# Output: www-data\n```\n\nBlind execution confirmed \u2014 output visible via file write side-channel, not in HTTP response.\n\n---\n\n## Fix Recommendation\n\nReplace `eval()` with a safe deserializer. e107 already uses `json_encode`/`json_decode` in newer code paths \u2014 the legacy `eval()` branch should be removed entirely:\n\n```php\n// BEFORE (vulnerable):\n$ArrayData = '$data = ' . $ArrayData . ';';\n@eval($ArrayData);\n\n// AFTER (safe):\n// Remove the eval() branch entirely.\n// Use json_decode() for all user_prefs values.\n// Migrate existing eval-format rows during upgrade.\n```\n\nAlternatively, add strict allowlisting so only known-safe array keys/values are accepted \u2014 but removing `eval()` entirely is the only safe fix.\n\n---\n\n## Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-07-14 | Vulnerability discovered and verified on local Docker instance |\n| 2026-07-17 | Submitted to VulnCheck CVD |\n| 2026-07-17 | CVE-2026-57859 provisionally allocated by VulnCheck |\n| 2026-07-17 | VulnCheck initiated outreach to e107 vendor |\n| 2026-11-14 | 120-day disclosure deadline |\n\n---\n\n## References\n\n- [e107 GitHub Repository](https://github.com/e107inc/e107)\n- [Vulnerable file: core_functions.php](https://github.com/e107inc/e107/blob/master/e107_handlers/core_functions.php)\n- [CWE-94: Improper Control of Generation of Code](https://cwe.mitre.org/data/definitions/94.html)\n- [CVSS 3.1 Vector: AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\n---\n\n*Discovered by: Saidakbarxon Maxsudxonov (@sermikroo)* \n*Coordinated disclosure via VulnCheck CVD Program*", "creation_timestamp": "2026-07-20T23:39:51.395012Z"} 2026-07-20T23:39:51.395012+00:00