Sql injection

2015-10-2114:59:00

PRIOn knowledge base

www.prio-n.com

8.7 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

78.9%

JSON

The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the db_like function.

CPENameOperatorVersion
drupal_7_driver_for_sql_server_and_sql_azureeq7.120.13
drupal_7_driver_for_sql_server_and_sql_azureeq7.120.11
drupal_7_driver_for_sql_server_and_sql_azureeq7.120.12
drupal_7_driver_for_sql_server_and_sql_azureeq7.120.10

Name	Operator	Version
drupal_7_driver_for_sql_server_and_sql_azure	eq	7.120.13
drupal_7_driver_for_sql_server_and_sql_azure	eq	7.120.11
drupal_7_driver_for_sql_server_and_sql_azure	eq	7.120.12
drupal_7_driver_for_sql_server_and_sql_azure	eq	7.120.10