Camer0N

**Nome do software vulnerável e versões afetadas: e107 versões 2.3.0 e anteriores Descrição: O problema está relacionado à ausência de um determinado mecanismo de proteção e TOKEN no arquivo usersettings.php. Isso afeta a segurança do software. Recomendações: Para as versões 2.3.0 e anteriores, atualize para uma versão que inclua o mecanismo de proteção e TOKEN no arquivo usersettings.php para resolver o problema.

**Name of the Vulnerable Software and Affected Versions** e107 version 2.1.8 **Description** The issue allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the `content type` set to 'image/jpeg'. This is possible due to a flaw in the 'e107 web/js/plupload/upload.php' file. **Recommendations** For e107 version 2.1.8, consider restricting the upload of files with .php extensions to prevent arbitrary PHP code execution until a patch is available. As a temporary workaround, restrict access to the 'e107 web/js/plupload/upload.php' file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** e107 version 2.1.4 **Description** The issue allows a malicious web page to use forged requests to make e107 download and install a plug-in provided by the attacker, due to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. **Recommendations** For version 2.1.4, consider disabling the plugin-installing feature until a patch is available to prevent exploitation. Restrict access to meta-changing and settings-changing functionalities to minimize the risk of cross-site request forgery attacks.