CVE-2012-4479: SQL Injection
Published Nov 30, 2012
·Updated
SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Software
2 affected components
David Alkire Drag \& Drop Gallery=6.x-1.5
Drupal Drupal
Remediation
Patch Available
Event History
Nov 30, 2012
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-4479?
CVE-2012-4479 is classified as a high severity SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands.
2
How do I fix CVE-2012-4479?
To fix CVE-2012-4479, upgrade the Drag & Drop Gallery module to version 6.x-1.6 or later.
3
Who is affected by CVE-2012-4479?
CVE-2012-4479 affects users of the Drag & Drop Gallery module version 6.x-1.5 on Drupal.
4
What type of attacks can be executed through CVE-2012-4479?
Attackers can execute arbitrary SQL commands, which may lead to data leakage or modification.
5
Is CVE-2012-4479 still a threat if I use an updated version of Drupal?
While using an updated version of Drupal may mitigate other vulnerabilities, you must ensure that the Drag & Drop Gallery module is also updated to avoid CVE-2012-4479.