14440 matches found
CVE-2014-8320
Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results configuration page...
CVE-2014-8317
The CVE-2014-8317 entry concerns Drupal’s Webform Validation module. A cross-site scripting (XSS) flaw exists in the component name text field in versions 6.x-1.x prior to 6.x-1.6 and 7.x-1.x prior to 7.x-1.4, allowing remote authenticated users with certain permissions to inject arbitrary web sc...
CVE-2014-8319
CVE-2014-8319 describes a cross-site scripting (XSS) vulnerability in the Drupal Easy Social module (version 7.x-2.x prior to 7.x-2.11). The issue arises from insufficient validation of block titles when users create a custom block via the module’s admin interface, allowing remote authenticated u...
CVE-2014-8317
Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text...
CVE-2014-8319
Cross-site scripting XSS vulnerability in the easysocialadminsummary function in the Easy Social module 7.x-2.x before 7.x-2.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a block title...
CVE-2014-8318
Cross-site scripting XSS vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title, when two fields hav...
CVE-2014-8318
The issue CVE-2014-8318 affects the Webform contributed module for Drupal. Affected versions: Webform 6.x-3.x before 6.x-3.20; 7.x-3.x before 7.x-3.20; and 7.x-4.x before 7.x-4.0-beta2. Description: remote authenticated users with certain permissions can inject arbitrary web script or HTML via a ...
CVE-2014-8320
The CVE-2014-8320 entry concerns Drupal's Custom Search module (6.x-1.x prior to 6.x-1.12 and 7.x-1.x prior to 7.x-1.14). The vulnerability is an XSS flaw where remote authenticated users with certain permissions can inject arbitrary web script or HTML via the "Label text" field on the results co...
Internet Bug Bounty: Drupal 7 pre auth sql injection and remote code execution
Motivation I found a SQL Injection bug in Drupal $value ... $newkeys$key . '' . $i = $value; The function assumes that it is called with an array which has no keys. Example: dbquery"SELECT FROM users where name IN :name", array':name'=array'user1','user2'; Which results in this SQL Statement SELE...
Drupal Core 7.32 SQL Injection
Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 Creditz to https://www.reddit.com/user/fyukyuk import urllib2,sys from drupalpass import DrupalHash https://github.com/cvangysel/gitexd-drupalorg/blob/master/drupalorg/drupalpass.py host = sys.argv1 user = sys.argv2...
Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerability
SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: Drupal - pre-auth SQL Injection Vulnerability Release Date: 2014/10/15 Last Modified: 2014/10/15 Author: Stefan Horst stefan.horstatsektioneins.de Application: Drupal = 7.0 = 7.31 Severity: Full SQL injection, which results in...
Drupal 7.0 7.31 - Drupalgeddon SQL Injection (Add Admin User)
Drupal 7.0 7.31 - Drupalgeddon SQL Injection Add Admin User !/usr/bin/python Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 Inspired by yukyuk's P.o.C https://www.reddit.com/user/fyukyuk Tested on Drupal 7.31 with BackBox 3.x This material is intended for...
Drupal 7.x SQL Injection
array 'method' = 'POST', 'header' = "Content-Type: application/x-www-form-urlencoded\r\n", 'content' = $postdata ; $ctx = streamcontextcreate$params; $data = filegetcontents$url . '?q=node&destination=node', null, $ctx; ifstristr$data, 'mbstrlen expects parameter 1 to be string' && $data echo...
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)
!/usr/bin/python Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 Inspired by yukyuk's P.o.C https://www.reddit.com/user/fyukyuk Tested on Drupal 7.31 with BackBox 3.x This material is intended for educational purposes only and the author can not be held liable fo...
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2)
array 'method' = 'POST', 'header' = "Content-Type: application/x-www-form-urlencoded\r\n", 'content' = $postdata ; $ctx = streamcontextcreate$params; $data = filegetcontents$url . '?q=node&destination=node', null, $ctx; ifstristr$data, 'mbstrlen expects parameter 1 to be string' && $data echo...
Drupal 7.0 7.31 - Drupalgeddon SQL Injection (PoC) (Reset Password) (2)
Drupal 7.0 7.31 - Drupalgeddon SQL Injection PoC Reset Password 2 array 'method' = 'POST', 'header' = "Content-Type: application/x-www-form-urlencoded\r\n", 'content' = $postdata ; $ctx = streamcontextcreate$params; $data = filegetcontents$url . '?q=node&destination=node', null, $ctx;...
Drupal Releases Security Advisory
Drupal has released a security advisory to address an application program interface API vulnerability CVE-2014-3704 that could allow an attacker to execute arbitrary SQL commands on an affected system. This vulnerability affects all Drupal core 7.x versions prior to 7.32. US-CERT advises users an...
Drupal 7.31 CORE pre Auth SQL Injection Vulnerability
Exploit for php platform in category web applications Advisory: Drupal - pre-auth SQL Injection Vulnerability Release Date: 2014/10/15 Last Modified: 2014/10/15 Author: Stefan Horst Application: Drupal = 7.0 = 7.31 Severity: Full SQL injection, which results in total control and code execution of...
FreeBSD : drupal7 -- SQL injection (6f825fa4-5560-11e4-a4c3-00a0986f28c4)
Drupal Security Team reports : Drupal 7 includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution...
