CVE-2008-3223

SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://drupal.org/node/280571	Patch Vendor Advisory
http://secunia.com/advisories/31079	Third Party Advisory
http://www.openwall.com/lists/oss-security/2008/07/10/3	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/30168	Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=454849	Issue Tracking Patch Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/43705	Third Party Advisory VDB Entry
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html	Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html	Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:8:::::::*
	cpe:2.3:o:fedoraproject:fedora:9:::::::*

History

No history.

Information

Published : 2008-07-18 16:41

Updated : 2021-04-15 13:49

NVD link : CVE-2008-3223

Mitre link : CVE-2008-3223

CVE.ORG link : CVE-2008-3223

JSON object : View

Products Affected

fedoraproject

fedora

drupal

drupal

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2008-3223", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2008-07-18T16:41:00.000", "references": [{"url": "http://drupal.org/node/280571", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/31079", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2008/07/10/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/30168", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=454849", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43705", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to \"an inappropriate placeholder for 'numeric' fields.\""}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en el Schema API de versiones de Drupal 6.x anteriores a 6.3 permite a atacantes remotos ejecutar comandos SQL arbitrarios a trav\u00e9s de vectores relacionados con un \"inadeacuado marcador de posici\u00f3n para campos 'num\u00e9ricos'\""}], "lastModified": "2021-04-15T13:49:50.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2B32D57-2123-41FB-9594-AF40304999A9", "versionEndExcluding": "6.3", "versionStartIncluding": "6.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72E4DB7F-07C3-46BB-AAA2-05CD0312C57F"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "743CBBB1-C140-4FEF-B40E-FAE4511B1140"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}