Synopsis: All versions of e107 have a vulnerability that allows html tags and content to be posted to the stats page and to be listed under Referers and may also list a screen size that they wish. Description: All versions of e107 have a vulnerability that allows html tags and content to be posted to the stats page and to be listed under Referers and thus allowing an attacker to put any site link or code they want on the list of Referers. The Problem lies within the e107 log plugin file /e107_plugins/log/log.php as it does not parse < > and / tags thus allowing a user to enter html content like so: target.com/e107_plugins/log/log.php?referer= code<br>goes<here> &color=24&eself=http://www.target.com/stats.php&res=1341X1341 This would print out: code goes here In the Referers list and print out a screen size of 1341x1341 with a color depth of 24. Impact: This could lead someone to graffiti the stats page with content of their liking which could further lead someone to input their account info, etc. With use of proxies someone may also advertise their site as the top referer. Work-around: The easiest way to fix this problem is to simply turn off stats all together. Even if you edit log.php to parse html tags people will still be able to post text to the Referers list.
