PT-2015-7652 · Drupal · Drupal

Published 2015-10-21 · Updated 2016-06-01 · CVE-2015-7876

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal 7 driver for SQL Server and SQL Azure versions prior to 7.x-1.4

Description The issue arises from the escapeLike function in sqlsrv/database.inc, which fails to properly escape certain characters. This allows remote attackers to execute arbitrary SQL commands, specifically through vectors involving a module that uses the db like function.

Recommendations For versions prior to 7.x-1.4, update to version 7.x-1.4 or later to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-7876

Affected Products

Drupal

References · 5

• https://drupal.org/node/2569577 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-7876 · Security Note
• https://drupal.org/node/2569003 · Patch
• https://drupal.org/node/2569005 · Patch
• http://cgit.drupalcode.org/sqlsrv/commit/?id=2ea0da8 · Note