Usmon Khudoyorov

**Name of the Vulnerable Software and Affected Versions** e107 versions prior to 2.3.8 **Description** A code execution issue exists in the `e array` deserialization handler. An attacker with out-of-band database write access can execute arbitrary PHP code by storing a crafted payload in the `user prefs` column. The `e array::unserialize()` function in e107 handlers/core functions.php only checks for the 'array' prefix before passing the value to `eval()`, which triggers execution when user preferences are processed via `e user pref::load()`. **Recommendations** Update to version 2.3.8 or later.