CVE-2008-3223: SQL Injection
Published Jul 18, 2008
·Updated
SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."
Affected Software
3 affected components
Drupal Drupal>=6.0<6.3
fedoraproject fedora=9
fedoraproject fedora=8
Remediation
Patch Available
Patch Available
Event History
Jul 18, 2008
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-3223?
CVE-2008-3223 is considered a critical severity SQL injection vulnerability that can lead to remote code execution.
2
How do I fix CVE-2008-3223?
To fix CVE-2008-3223, upgrade your Drupal installation to version 6.3 or later which includes the necessary security patch.
3
Which versions of Drupal are affected by CVE-2008-3223?
CVE-2008-3223 affects all versions of Drupal 6.x prior to 6.3.
4
Can CVE-2008-3223 affect my web application?
Yes, if your web application uses affected versions of Drupal 6.x, it is vulnerable to SQL injection attacks.
5
What types of attacks can exploit CVE-2008-3223?
CVE-2008-3223 can be exploited to execute arbitrary SQL commands, potentially compromising the entire database.