PT-2015-7652 · Drupal · Drupal

Publicado 2015-10-21 · Atualizado 2016-06-01 · CVE-2015-7876

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal 7 driver for SQL Server and SQL Azure versions prior to 7.x-1.4

Description The issue arises from the escapeLike function in sqlsrv/database.inc, which fails to properly escape certain characters. This allows remote attackers to execute arbitrary SQL commands, specifically through vectors involving a module that uses the db like function.

Recommendations For versions prior to 7.x-1.4, update to version 7.x-1.4 or later to resolve the issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-7876

Produtos afetados

Drupal

Referências · 5

• http://cgit.drupalcode.org/sqlsrv/commit/?id=2ea0da8 · Nota
• https://drupal.org/node/2569577 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2015-7876 · Nota de Segurança
• https://drupal.org/node/2569003 · Correção
• https://drupal.org/node/2569005 · Correção