CVEvulnerability
CVE-2007-5416
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2007-10-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-189
Description
Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupal_eval function through a callback parameter to the default URI, as demonstrated by the _menu[callbacks][1][callback] parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Drupal.
Affected configurations
• drupal drupal (<= 5.2)
Related
Weakness · not in database (1)
References
- http://securityreason.com/securityalert/3216 securityreason.com
- http://securityvulns.ru/Sdocument137.html Exploit
- http://www.securityfocus.com/archive/1/482006/100/0/threaded www.securityfocus.com
- https://www.exploit-db.com/exploits/4510 www.exploit-db.com
- http://securityreason.com/securityalert/3216 securityreason.com
- http://securityvulns.ru/Sdocument137.html Exploit
- http://www.securityfocus.com/archive/1/482006/100/0/threaded www.securityfocus.com
- https://www.exploit-db.com/exploits/4510 www.exploit-db.com