CVE-2008-4785: SQL injection vulnerability in newuser.php in the alternate_profiles plugin, possibly 0.2, for e107 allows...

Security readout for executives and security teams

This CVE describes a SQL injection flaw in the e107 alternate_profiles plugin’s newuser.php page. If a vulnerable site exposes that plugin, a remote attacker could manipulate the id parameter to run database queries. Public metadata is old and incomplete, so urgency depends on whether this legacy plugin exists in your environment. Exposure is most likely on legacy e107 installations using the alternate_profiles plugin with newuser.php reachable from the internet. The source bundle does not provide authoritative affected CPEs or a confirmed version range beyond “possibly 0.2.” Prioritize fast inventory over broad emergency response. This is a serious class of vulnerability, but the main business risk is concentrated in old, exposed e107 sites running a specific plugin. Mitigation focus: Inventory e107 sites and check whether alternate_profiles is installed.; Restrict public access to newuser.php if business use is not required.; Check e107 and plugin vendor or maintainer guidance for fixes..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.