------------SA-2007-031 - DRUPAL CORE - SQL INJECTION POSSIBLE WHEN CERTAIN CONTRIBUTED MODULES ARE ENABLED------------
* Advisory ID: DRUPAL-SA-2007-031
* Project: Drupal core
* Version: 4.7.x, 5.x
* Date: 2007-December-05
* Security risk: Moderately critical
* Exploitable from: Remote
* Vulnerability: SQL Injection
------------DESCRIPTION------------
The function taxonomy_select_nodes() directly injects variables into SQL queries instead of using placeholders. While taxonomy module itself validates the input passed to taxonomy_select_nodes(), this is a weakness in Drupal core. Several contributed modules, such as taxonomy_menu [
http://drupal.org/project/taxonomy_menu ], ajaxLoader [
http://drupal.org/project/ajaxloader ], and ubrowser [
http://drupal.org/project/uBrowser ], directly pass user input to taxonomy_select_nodes(), enabling SQL injection attacks by anonymous users.
To learn more about SQL injection, please read this article [
http://en.wikipedia.org/wiki/SQL_injection ].
------------VERSIONS AFFECTED------------
* Drupal 4.7.x before Drupal 4.7.9
* Drupal 5.x before Drupal 5.4
------------SOLUTION------------
Install the latest version:
* If you are running Drupal 4.7.x then upgrade to Drupal 4.7.9 [
http://ftp.drupal.org/files/projects/drupal-4.7.9.tar.gz ].
* If you are running Drupal 5.x then upgrade to Drupal 5.4 [
http://ftp.drupal.org/files/projects/drupal-5.4.tar.gz ].
If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade.
* To patch Drupal 4.7.8 use SA-2007-031-4.7.8.patch [
http://drupal.org/files/sa-2007-031/SA-2007-031-4.7.8.patch ].
* To patch Drupal 5.3 use SA-2007-031-5.3.patch [
http://drupal.org/files/sa-2007-031/SA-2007-031-5.3.patch ].
------------REPORTED BY------------
* Nadid Skywalker
* Ivan Sergio Borgonovo
------------CONTACT------------
The security contact for Drupal can be reached at security at drupal.org or via the form at [
http://drupal.org/contact ].