## Summary
CVE-2026-72599 describes an SQL injection in e107 2.4.0 affecting the news item page. The vulnerability is reachable by unauthenticated remote attackers and can lead to full database compromise, including administrator credentials.
## Technical Details
- Vulnerability type: SQL injection (CWE-89).
- Affected input: the news item page ID parameter.
- Root cause (per NVD): the ID parameter is concatenated into a SQL WHERE clause without proper escaping/parameterization.
- Attack prerequisites: none beyond network reachability of the vulnerable news item page.
- Impacted operations (per NVD): attackers can read, modify, or delete all database contents.
- Privilege context: PR:N / unauthenticated (AV:N, AC:L, UI:N).
## Affected
- e107 CMS 2.4.0.
## Impact
- Unauthenticated remote SQL injection enabling full database compromise.
- Confidentiality: exposure of all database contents, including administrator credentials (C:H).
- Integrity: attacker can alter database records (I:H).
- Availability: attacker can delete data and disrupt service (A:H).
## Mitigation
1. Patch immediately by upgrading e107 to a version that addresses the SQL injection in the news item page ID parameter.
2. If patching is not immediately possible, restrict network access to the affected news item endpoints (reduce exposure to unauthenticated traffic).
3. Implement compensating controls: add WAF/IPS rules to detect SQLi patterns targeting the news item ID parameter and block suspicious requests.
4. Perform incident response steps if exploitation is suspected: rotate administrator credentials and review database integrity.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-89