What is the severity of CVE-2007-5416?

CVE-2007-5416 is considered a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2007-5416?

To fix CVE-2007-5416, upgrade Drupal to version 5.3 or later, as this issue is resolved in those releases.

Who is affected by CVE-2007-5416?

CVE-2007-5416 affects Drupal versions 5.2 and earlier.

What kind of attacks can CVE-2007-5416 facilitate?

CVE-2007-5416 can facilitate remote code execution attacks allowing attackers to run arbitrary PHP code.

Is there a workaround for CVE-2007-5416 if I cannot upgrade?

There is no effective workaround for CVE-2007-5416, and the best course of action is to upgrade to a secure version.

Vulnerability/
CVE-2007-5416

medium

6.8

CWE

189

12/10/2007

7/8/2024

CVE-2007-5416

First published: Fri Oct 12 2007(Updated: )

Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupal_eval function through a callback parameter to the default URI, as demonstrated by the _menu[callbacks][1][callback] parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Drupal.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Drupal Drupal	<=5.2

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2007-5416?
CVE-2007-5416 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2007-5416?
To fix CVE-2007-5416, upgrade Drupal to version 5.3 or later, as this issue is resolved in those releases.
Who is affected by CVE-2007-5416?
CVE-2007-5416 affects Drupal versions 5.2 and earlier.
What kind of attacks can CVE-2007-5416 facilitate?
CVE-2007-5416 can facilitate remote code execution attacks allowing attackers to run arbitrary PHP code.
Is there a workaround for CVE-2007-5416 if I cannot upgrade?
There is no effective workaround for CVE-2007-5416, and the best course of action is to upgrade to a secure version.

collector/nvd-historical
collector/nvd-index
agent/type
agent/references
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/severity
agent/weakness
agent/last-modified-date
agent/author
agent/tags
agent/description
agent/first-publish-date
agent/event
agent/source
vendor/drupal
canonical/drupal drupal
version/drupal drupal/5.2

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2007-5416?
CVE-2007-5416 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2007-5416?
To fix CVE-2007-5416, upgrade Drupal to version 5.3 or later, as this issue is resolved in those releases.
Who is affected by CVE-2007-5416?
CVE-2007-5416 affects Drupal versions 5.2 and earlier.
What kind of attacks can CVE-2007-5416 facilitate?
CVE-2007-5416 can facilitate remote code execution attacks allowing attackers to run arbitrary PHP code.
Is there a workaround for CVE-2007-5416 if I cannot upgrade?
There is no effective workaround for CVE-2007-5416, and the best course of action is to upgrade to a secure version.