CVE-2007-5593

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-10-19 · updated 2026-06-16
Weakness: CWE-94

Description

install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vectors that cause settings.php to be modified.

Affected products

Drupal: from 5.0 before 5.3 — fixed in 5.3
Fedoraproject Fedora: 7

How to fix

Upgrade to a fixed version: Drupal 5.3. Check the vendor advisory for mitigations.

References

http://drupal.org/files/sa-2007-025/SA-2007-025-5.2.patch
http://drupal.org/node/184316
http://osvdb.org/39648
http://secunia.com/advisories/27290
http://secunia.com/advisories/27352
http://www.securityfocus.com/bid/26119
https://exchange.xforce.ibmcloud.com/vulnerabilities/37265
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00328.html
http://drupal.org/files/sa-2007-025/SA-2007-025-5.2.patch
http://drupal.org/node/184316
http://osvdb.org/39648
http://secunia.com/advisories/27290

Get alerted when CVE-2007-5593 or the next vulnerability affects your stack