PT-2008-5447 · Drupal · Drupal Mailhandler Module

Published 2008-09-19 · Updated 2017-08-08 · CVE-2008-4148

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal Mailhandler module versions 5.x before 5.x-1.4 Drupal Mailhandler module versions 6.x before 6.x-1.4

Description The issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to composing queries without using the Drupal database API.

Recommendations For Drupal Mailhandler module version 5.x, update to version 5.x-1.4 or later. For Drupal Mailhandler module version 6.x, update to version 6.x-1.4 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-4148

Affected Products

Drupal Mailhandler Module

References · 6

• http://secunia.com/advisories/31877 · Vendor Advisory
• http://drupal.org/node/309769 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-4148 · Security Note
• http://securityfocus.com/bid/31230 · Patch
• http://vupen.com/english/advisories/2008/2616 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45216 · Note