A critical vulnerability in e107 CMS version 3.2.1 allows authenticated administrators to execute arbitrary code by overwriting system files via the Media Manager.

This is an unrestricted file upload vulnerability (CWE-434) located in the Media Manager import functionality. An authenticated administrator can manipulate the upload URL parameter to bypass file type restrictions and overwrite critical server files, such as PHP configuration or source files, leading to remote code execution.

The ability to overwrite server files represents a total compromise of the application integrity and availability. An attacker with administrative access can leverage this flaw to gain full remote code execution on the underlying host, potentially leading to unauthorized data access, complete system takeover, or persistent backdoor installation. With a CVSS score of 8.8, this vulnerability is considered High severity, particularly because it facilitates full system compromise.

Immediate Action: Upgrade to the latest version of e107 CMS that addresses this file upload restriction bypass. If an immediate update is not feasible, disable the remote upload functionality within the Media Manager.

Proactive Monitoring: Review web server access and error logs for suspicious POST requests targeting the Media Manager import endpoint. Monitor the file system for unexpected modifications to core PHP files or the creation of unauthorized executable scripts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests containing malicious upload URL parameters or attempts to upload files with dangerous extensions. Ensure the web server process runs with the least privilege necessary to prevent lateral movement if the application is compromised.

Public Exploit Available: Yes — a published proof-of-concept exists in the Exploit-DB entry 50910.

Given the potential for complete system compromise via remote code execution, organizations running e107 CMS version 3.2.1 must prioritize remediation. Administrators should apply the vendor-provided security updates immediately to close the upload bypass vector. Failure to patch this vulnerability leaves the environment exposed to attackers who have already obtained administrative credentials, effectively granting them full control over the web server.