CVE-2008-3223: SQL Injection
First published: Fri Jul 18 2008(Updated: )
SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Drupal | >=6.0<6.3 | |
| Fedora | =8 | |
| Fedora | =9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2008/07/10/3
- http://drupal.org/node/280571
- http://www.securityfocus.com/bid/30168
- https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.html
- http://secunia.com/advisories/31079
- https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html
- https://bugzilla.redhat.com/show_bug.cgi?id=454849
- https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43705
Frequently Asked Questions
What is the severity of CVE-2008-3223?
CVE-2008-3223 is considered a critical severity SQL injection vulnerability that can lead to remote code execution.
How do I fix CVE-2008-3223?
To fix CVE-2008-3223, upgrade your Drupal installation to version 6.3 or later which includes the necessary security patch.
Which versions of Drupal are affected by CVE-2008-3223?
CVE-2008-3223 affects all versions of Drupal 6.x prior to 6.3.
Can CVE-2008-3223 affect my web application?
Yes, if your web application uses affected versions of Drupal 6.x, it is vulnerable to SQL injection attacks.
What types of attacks can exploit CVE-2008-3223?
CVE-2008-3223 can be exploited to execute arbitrary SQL commands, potentially compromising the entire database.
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/references
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/drupal
- canonical/drupal
- version/drupal/6.0
- vendor/fedoraproject
- canonical/fedora
- version/fedora/8
- version/fedora/9