CVE-2010-2099

bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attackers to execute arbitrary PHP code, as demonstrated using the toEmail method in contact.php, related to invocations of the toHTML method.

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

4.87% chance of exploitation in the next 30 days, 92nd percentile

Published

2010-05-27

Updated

2024-09-17

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/12715

Security advisories

• http://www.securityfocus.com/bid/40252

References

• CVE Record
• NVD entry