PT-2006-3662 · Drupal · Drupal

Ayman Hourieh + 1 · Published 2006-06-01 · Updated 2018-10-18 · CVE-2006-2742

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal versions 4.6.x through 4.6.6 Drupal version 4.7.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the count and from variables in the files database.mysql.inc, database.pgsql.inc, and database.mysqli.inc.

Recommendations For Drupal versions 4.6.x through 4.6.6, update to version 4.6.7 or later. For Drupal version 4.7.0, update to a version later than 4.7.0.

Fix

Related Identifiers

CVE-2006-2742

DSA-1125

Affected Products

Drupal

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-2742 · Security Note
• http://drupal.org/node/65357 · Vendor Advisory
• http://debian.org/security/2006/dsa-1125 · Vendor Advisory
• http://secunia.com/advisories/20140 · Vendor Advisory
• http://securityfocus.com/bid/18245 · Note
• http://secunia.com/advisories/21244 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26654 · Note
• http://vupen.com/english/advisories/2006/1975 · Note
• http://securityfocus.com/archive/1/435790/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2742 · Note