e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.

Published May 24, 2019 · Updated Aug 6, 2024 · Assigned by mitre