CVE-2022-50916
📋 TL;DR
CVE-2022-50916 is a file upload vulnerability in e107 CMS version 3.2.1 that allows authenticated administrators to overwrite server files through Media Manager import functionality. Attackers can manipulate upload parameters to replace critical web application files like top.php. This affects all e107 CMS 3.2.1 installations with administrator accounts.
💻 Affected Systems
- e107 CMS
📦 What is this software?
E107 by E107
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through arbitrary file overwrite leading to remote code execution, data theft, or website defacement.
Likely Case
Website defacement, data manipulation, or limited file system access through overwriting web application files.
If Mitigated
Limited impact if proper file permissions and input validation are in place, though file overwrite may still occur.
🎯 Exploit Status
Exploit requires administrator credentials. Public exploit code available on Exploit-DB (ID 50910).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.2
Vendor Advisory: https://e107.org/
Restart Required: No
Instructions:
1. Backup current installation. 2. Download e107 CMS 3.2.2 from official site. 3. Replace vulnerable files with patched version. 4. Verify Media Manager functionality.
🔧 Temporary Workarounds
Disable Media Manager Import
allTemporarily disable the Media Manager import functionality to prevent exploitation.
# Edit e107 configuration to disable Media Manager import
Restrict File Permissions
linuxSet web directory files to read-only for web server user.
chmod 444 /path/to/e107/web/files/*.php
🧯 If You Can't Patch
- Implement strict access controls on administrator accounts with MFA
- Monitor file system changes in web directories and alert on unauthorized modifications
🔍 How to Verify
Check if Vulnerable:
Check e107 version in admin panel or via version.php file. If version is 3.2.1, system is vulnerable.Check Version:
grep -r "e107_version" /path/to/e107/install/Verify Fix Applied:
Verify version is 3.2.2 or higher. Test Media Manager import with malicious payloads to confirm rejection.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads via Media Manager
- Multiple failed import attempts
- File modification timestamps on critical PHP files
Network Indicators:
- POST requests to /e107_admin/media_manager.php with manipulated parameters
SIEM Query:
source="web_logs" AND uri="/e107_admin/media_manager.php" AND method="POST" AND (param="upload_url" OR param="import_url")