| VID |
21648 |
| Severity |
40 |
| Port |
80, ... |
| Protocol |
TCP |
| Class |
CGI |
| Detailed Description |
The Drupal, according to its version number, has an arbitrary PHP code execution vulnerability. Drupal is an open-source content management system written in PHP. Drupal versions 4.5.0 though 4.5.3 and 4.6.0 though 4.6.1 could allow a remote attacker to execute arbitrary PHP code, caused by a vulnerability in the input validation routines of Drupal's filter mechanism. A remote attacker could exploit this vulnerability to execute arbitrary PHP code on a target system when public comments or postings are allowed.
* Note: This check solely relied on the version number of the Drupal installed on the remote Web server to assess this vulnerability, so this might be a false positive.
* References:
http://drupal.org/files/sa-2005-002/advisory.txt
http://secunia.com/advisories/15872/
* Platforms Affected:
Drupal versions prior to 4.5.4
Drupal versions prior to 4.6.2
Any operating system Any version |
| Recommendation |
Either disable public comments and postings, or upgrade to the latest version of Drupal (4.5.4 or 4.6.2 or later), available from the Drupal Web site at http://drupal.org/project/drupal |
| Related URL |
CVE-2005-2106 (CVE) |
| Related URL |
14110 (SecurityFocus) |
| Related URL |
(ISS) |
|
