CWE Code: 502
Vulnerability Type: sql_injection
CVSS Score: 6.5
CWE Name:  Deserialization of Untrusted Data
Summary: e107 2.1.2 allows php object injection with resultant sql injection, because usersettings.php uses unserialize without an hmac.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-05-24
Last Modified Date: 2019-05-29