Multiple SQL injection vulnerabilities in Drupal and vbDrupal 4.7.x before 4.7.9 and 5.x before 5.4 allow remote attackers to execute arbitrary SQL commands via modules that pass input to the taxonomy_select_nodes function, as demonstrated by the (1) taxonomy_menu, (2) ajaxLoader, and (3) ubrowser contributed modules.

The Drupal Project reports :

The function taxonomy_select_nodes() directly injects variables into SQL queries instead of using placeholders. While taxonomy module itself validates the input passed to taxonomy_select_nodes(), this is a weakness in Drupal core. Several contributed modules, such as taxonomy_menu, ajaxLoader, and ubrowser, directly pass user input to taxonomy_select_nodes(), enabling SQL injection attacks by anonymous users.

5.4, fixes a few security issues, as well as a README update.

Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
29690	FreeBSD : drupal -- SQL injection vulnerability (fa708908-a8c7-11dc-b41d-000fb5066b20)	Nessus	FreeBSD Local Security Checks	high
29273	Fedora 8 : drupal-5.4-1.fc8 (2007-4163)	Nessus	Fedora Local Security Checks	high
29270	Fedora 7 : drupal-5.4-1.fc7 (2007-4136)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2007-6299

critical

Tenable Plugins

high

high

high