SQL Injection in Drupal - #VU584

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU584

SQL Injection in Drupal - #VU584

Published: September 21, 2016


Vulnerability identifier: #VU584
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Drupal
Affected software:
Drupal

Detailed vulnerability description

The vulnerability allows a remote user to perform SQL injection attack on the target system.
The weakness exists due to security bypass. Certain queries allowed to be submitted to the database without any checking can easily bypass access control and allow attackers to inject special SQL-code.
Successful exploitation of the vulnerability may result in SQL injection on the vulnerable system.

Remediation


Sources