CVE-2007-6299

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-12-10 · updated 2026-06-16
Weakness: CWE-20

Description

Multiple SQL injection vulnerabilities in Drupal and vbDrupal 4.7.x before 4.7.9 and 5.x before 5.4 allow remote attackers to execute arbitrary SQL commands via modules that pass input to the taxonomy_select_nodes function, as demonstrated by the (1) taxonomy_menu, (2) ajaxLoader, and (3) ubrowser contributed modules.

Affected products

Drupal: 4.0.0, 4.1.0, 4.2.0_rc, 4.4.0, 4.4.1, 4.4.2 (+37)

References

http://drupal.org/node/198162
http://secunia.com/advisories/27932
http://secunia.com/advisories/27951
http://secunia.com/advisories/27973
http://sourceforge.net/project/shownotes.php?release_id=559532
http://sourceforge.net/project/shownotes.php?release_id=559538
http://www.securityfocus.com/bid/26735
https://exchange.xforce.ibmcloud.com/vulnerabilities/38884
https://exchange.xforce.ibmcloud.com/vulnerabilities/38886
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00190.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00258.html
http://drupal.org/node/198162

Get alerted when CVE-2007-6299 or the next vulnerability affects your stack