CVE-2015-7876

2015-10-2114:00:00

mitre

www.cve.org

8 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

79.0%

JSON

The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the db_like function.