Description

Multiple SQL injection vulnerabilities in Drupal and vbDrupal 4.7.x before 4.7.9 and 5.x before 5.4 allow remote attackers to execute arbitrary SQL commands via modules that pass input to the taxonomy_select_nodes function, as demonstrated by the (1) taxonomy_menu, (2) ajaxLoader, and (3) ubrowser contributed modules.

Remediation

References

CVE-2007-6299

Related Vulnerabilities

b2evolution Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2012-5910)

Apache HTTP Server URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-10098)

Oracle JRE CVE-2013-2428 Vulnerability (CVE-2013-2428)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-14720)

Internet Information Services Other Vulnerability (CVE-2000-0024)

Severity

High

Classification

CVE-2007-6299 CWE-20

Tags

Missing Update Known Vulnerabilities