Drupal7 Pre Auth SQLI

Description

SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can lead to data theft, modification of database records, unauthorized access, and even control over the entire database management system (DBMS).

Recommendation

Update Drupal

References

Drupal
OWASP: SQL Injection
OWASP: ESAPI project
Wikipedia: Prepared statement
CVE-2014-3704
CWE-20
CWE-89
CAPEC-66
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Drupal7 Pre Auth SQLI and gives you actionable findings to investigate.

Start a free scan

Related Issues

WordPress Plugin Google Document Embedder 2.5.16 SQLI - CVE-2014-9173
WordPress Plugin AdRotate 3.9.4 SQLI - CVE-2014-1854
WordPress Plugin Google Document Embedder 2.5.14 SQLI - CVE-2014-9173
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection - CVE-2026-43945

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

These 7 PHP mistakes leave your website open to the hackers

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated May 13, 2024