Description

Multiple SQL injection vulnerabilities in Drupal and vbDrupal 4.7.x before 4.7.9 and 5.x before 5.4 allow remote attackers to execute arbitrary SQL commands via modules that pass input to the taxonomy_select_nodes function, as demonstrated by the (1) taxonomy_menu, (2) ajaxLoader, and (3) ubrowser contributed modules.

Remediation

References

CVE-2007-6299

Related Vulnerabilities

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-3827)

WordPress Plugin Ldap WP Login/Active Directory Integration Multiple Vulnerabilities (3.0.1)

Oracle JRE CVE-2022-21340 Vulnerability (CVE-2022-21340)

Jboss EAP Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2018-10237)

Jenkins Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-1000356)

Severity

High

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2007-6299