e107-extract-code-execution (44268) The risk level is classified as HighHigh Risk


Description:

e107 could allow a remote attacker to execute arbitrary code on the system, caused by an error in the download.php extract function. By sending a specially-crafted HTTP post request to the downloads category view page, an attacker could exploit this vulnerability to execute arbitrary code on the system when the download category is known.

Platforms Affected:

* e107, e107 0.7.11

Remedy:

Apply the patch for this vulnerability (Revision: 1.96 or later), available from the e107 CVS repository. See References.

Consequences:

Gain Access

References:

* e107 CVS repository, e107 at
* e107 Web site, e107.org News at
* GulfTech Research And Development, Friday August 8, 2008, e107 <= 0.7.11 Arbitrary Variable Overwriting at
* SA31394: e107 download.php "extract()" Vulnerability

Reported:

Aug 07, 2008


Original Source:



Thanks to Veskoto for bringing this one up!    

Posted by -=Mojo Will=- on 18 Aug |  Comments: 2  |          

e107Designs has launched a new system for analyzing and reviewing submitted themes. We think and hope that this system could provide an understandable and useful method for designers to get their themes reviewed.
This system gives points to each theme as a representing way for its review, and each theme get its analysis in its download page. As also i want to say that the amount of points that any theme may get, doesn't necessarily represent its quality or how good it is, but it just represents what features we hope themers take more care about, and we hope that way in the end may help by improving e107 themes quality and encourage themers for more.
For this system, we have created a reviewing and analyzing team to keep tracking of all submitted themes, So we need candidates for this team so we can provide more for this new system. If you see you can help us in this matter, please don't hesitate to send me or eweqnet a pm.
To read the rules and how we give themes their points, visit Review system main page. Also you can help by giving us your comments at this page including your ideas, thoughts, and anything could help related to this subject.    

Posted by deebocean on 28 Jul |  Comments: 0  |          

eWeq-TEAM finally opened there site where you can request themes share your opinion and write about problems with the themes.You will find the team members and become one of them.Stay tuned for the newest themes by eWeq-TEAM!


Please write your comments about the site!
[Submitted by eweqnet]    

Posted by -=Mojo Will=- on 27 Jul |  Comments: 5  |          

Thank you all for supporting e107designs over the past 18 months. Today we hit 10,000 registered users. Whilst we all apprecaite that not everyone sticks around forever and that a few signups may be nasty spam type things I still acknowledge it as a pretty big milestone.

It just proves that we are THE site for e107 themes!

A few thank yous:

TheDude (for originally coming up with the site!)
-=Mojo Will=- (for hosting the site for the last 14 months)
Deebocean (for his continued support in everything)
Monsta (for all his work on the theme and our sweet logo)
Joei (for the theme work)
Webbie Webb (for his great forum icons)
The Free-source Team (for loads of help on the theme!)
Eweqnet and Team (for theme work and great submissions)

if I haven't mentioned you I am very sorry, but a BIG thanks as well!

See you all at 20,000!!    

Posted by -=Mojo Will=- on 25 Jul |  Comments: 6  |          

Please ensure when you do submit a new theme for upload that you include a screenshot. NO THEME WILL BE APPROVED that doesn't include a screenshot!

Thanks    

Posted by -=Mojo Will=- on 20 Jul |  Comments: 0  |          

This is the download template used here (e107Design.org), which has more enhanced and much more different view from the core one as you can see at our download section.
for installation instruction, read readme.txt inside.



Enhanced Download Template
    Read more

Posted by deebocean on 05 Jul |  Comments: 0  |