Drupal 7.x /includes/database/database.inc SQL注入漏洞

Includes/database/database.inc protected function expandArguments&$query, &$args $modified = FALSE; foreach arrayfilter$args, 'isarray' as $key = $data $newkeys = array; foreach $data as $i = $value $newkeys$key . '' . $i = $value; $query = pregreplace'' . $key . '\b', implode', ',...

Drupal Core SQLi Vulnerability (SA-CORE-2014-005) - Active Check

Drupal is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

SA-CONTRIB-2014-103 - Passwordless - Cross Site Scripting (XSS)

This module replaces the regular Drupal login form with a modification of the password-request form, to give the possibility to log in without using a password. The module doesn't sufficiently sanitize user-generated text entered in the module's configuration form. This vulnerability is mitigated...

SA-CONTRIB-2014-106 - Commerce Authorize.Net SIM/DPM Payment Methods - Access Bypass

This module provides payment methods for the Drupal Commerce package to permit the use of the Authorize.Net payment gateway's SIM and DPM payment protocols. Access Bypass The module doesn't sufficiently protect the Drupal Commerce order number passed to the Authorize.Net payment gateway, allowing...

SA-CONTRIB-2014-105 - OG Menu - Access Bypass

OG Menu allows using menus within Organic Groups. The permissions for accessing the module settings were to broad, possibly granting access to users who would normally not be able to change the OG Menu configuration. This vulnerability is mitigated by the fact that an attacker must have a role wi...

Drupal Releases Public Service Announcement

Drupal released a public service announcement to address active exploitations of a previously patched vulnerability found in Drupal core 7.x versions prior to 7.32. US-CERT advises users and administrators to review Drupal's Public Service announcement and apply the necessary updates or...

callback nightmare: parsing of the famous CMS frameworks Drupal SQL injection vulnerability-vulnerability warning-the black bar safety net

Drupal is using the PHP language, open source content management framework CMF, which consists of CMS and PHP development framework together constitute. Consecutive years won the world's best CMS award, is based on the PHP language the most famous WEB applications. A few days before the explosion...

SA-CONTRIB-2014-104 - Addressfield Tokens - Cross Site Scripting

The Addressfield Tokens module extends the Addressfield module by adding full token support. The module doesn't sufficiently filter malicious user input, opening a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

[SECURITY] Fedora 20 Update: drupal7-7.32-1.fc20

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

Drupal 7.31 SQL injection getshell exploit detailed and EXP-vulnerability warning-the black bar safety net

0x00 This vulnerability might indeed be great, and Drupal used more also, using Fuzzing to run the dictionary should be swept out of the many vulnerabilities of the host, but do the bulk may be on the other site cause a lot of loss, so I will just write a Exp is no longer deep down. 0x01 On the...

CVE-2013-4594

The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment...

Design/Logic Flaw

The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment...

CVE-2013-4594

The CVE-2013-4594 vulnerability affects the Drupal Payment for Webform module (7.x-1.x) prior to 7.x-1.5. It allows remote anonymous users to access/consume payments made by other anonymous users when submitting a form requiring payment due to insufficient access controls. Remediation: upgrade to...

MGASA-2014-0423 Updated drupal packages fix security vulnerability

An SQL Injection issue exists in Drupal before 7.32 due to the way the Drupal core handles prepared statements. A malicious user can inject arbitrary SQL queries, and thereby completely control the Drupal site. This vulnerability can be exploited by remote attackers without any kind of...

Updated drupal packages fix security vulnerability

An SQL Injection issue exists in Drupal before 7.32 due to the way the Drupal core handles prepared statements. A malicious user can inject arbitrary SQL queries, and thereby completely control the Drupal site. This vulnerability can be exploited by remote attackers without any kind of...

CVE-2013-7407

Cross-site request forgery CSRF vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2013-7407

Cross-site request forgery CSRF vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2013-7407

Technical details are not publicly available in the provided documents. The description notes a CSRF vulnerability in Drupal's MRBS module, but there are no concrete affected versions, root cause, fixes, or exploitation details in the supplied materials. Monitor for updates.

Drupal 7. x SQL Injection exp (CVE-2 0 1 4-3 7 0 4)-vulnerability warning-the black bar safety net

| 1 | import urllib2,sys ---|--- 2 | from drupalpass import DrupalHash https://github.com/cvangysel/gitexd-drupalorg/blob/master/drupalorg/drupalpass.py ---|--- 3 | if lensys. argv != 4: ---|--- 4 | print "" ---|--- 5 | print "python 7.xSQL.py admin 1 2 3 4 5 6" ---|--- 6 | print "" ---|--- 7 |...