CVE-2026-72599

The 9.8 CVSS score assigned to this SQL injection in e107's news module actually understates the real-world exploitability for one simple reason no vulnerability metric captures: the attack surface was already mapped before the vulnerability had a name. This injection lives in a news item page—one of the most indexed, most linked, and most frequently accessed endpoints in any CMS deployment. The required parameter (a news item ID) isn't a secret requiring enumeration; it's sitting in search engine caches, Wayback Machine snapshots, and referrer logs across the entire exposed fleet. An attacker doesn't need to scan, probe, or discover anything. They pull the ID from a cached page or simply guess the sequential pattern, and they're ready to fire. CVSS treats network accessibility as binary, but it cannot weight the probability that the exact trigger value was already passively collected years before disclosure. This is compounded by e107's deployment profile. The CMS runs heavily in municipal sites, community portals, and small organization deployments that rarely maintain aggressive patch cycles. A 9.8 on a hardened enterprise asset means 'urgent but manageable.' A 9.8 on an unpatched e107 fleet means 'trivial to exploit at scale' because the vulnerable population decays slowly, automated scanners already have target lists built from indexed pages, and many affected deployments lack any security monitoring to detect exploitation in the first place. The deeper structural issue: this is not an isolated developer error. Direct SQL concatenation in a public handler is a symptom of framework architecture that makes unsafe query construction the path of least resistance. If the patch addresses only this specific parameter, it treats the symptom while the underlying pattern likely persists across other public-facing query handlers in e107 core. The next developer facing deadline pressure will reach for the same concatenation pattern unless the framework actively prevents it. For defenders, the immediate priority is identifying whether your e107 deployment exposes the news module publicly, whether you're on a version branch that will receive this patch without breaking changes, and whether your deployment has any mechanism to detect anomalous SQL error patterns or unauthorized data access. Assume the parameter is already known to adversaries. The clock started before the CVE existed.

Reviewed through automated stages and approved by a human before publication.