Code injection

2012-12-0321:55:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

72.9%

JSON

The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the “send scheduled newsletters” permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron.

CPENameOperatorVersion
simplenews_schedulereq6.120.20
simplenews_schedulereq6.x-2.0 beta4
simplenews_schedulereq6.x-2.0 beta2
simplenews_schedulereq6.x-2.0 beta3
simplenews_schedulereq6.120.21
simplenews_schedulereq6.120.22
simplenews_schedulereq6.120.23
simplenews_schedulereq6.x-2.x dev

Name	Operator	Version
simplenews_scheduler	eq	6.120.20
simplenews_scheduler	eq	6.x-2.0 beta4
simplenews_scheduler	eq	6.x-2.0 beta2
simplenews_scheduler	eq	6.x-2.0 beta3
simplenews_scheduler	eq	6.120.21
simplenews_scheduler	eq	6.120.22
simplenews_scheduler	eq	6.120.23
simplenews_scheduler	eq	6.x-2.x dev