Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2007-5416: Drupal 5.2 permits remote code execution via crafted request

CVE-2007-5416 · published 19 years ago

Summary

Websites running Drupal version 5.2 or older can be tricked into running any server-side code an attacker supplies. By sending specially formed input, an attacker can cause the system to execute malicious commands, potentially taking full control of the site. Update Drupal to a newer version or apply the provided security patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
drupal	drupal	<= 5.2 `cpe:2.3:a:drupal:drupal::::::::`

Original advisory text

Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupal_eval function through a callback parameter to the default URI, as demonstrated by the _menu[callbacks][1][callback] parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Drupal.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.8 Medium

Exploitation

4% chance of attack within 30 days

Type

CWE-189Numeric Errors

Timeline

Published12 Oct 2007

Updated24 Oct 2026

First seen29 Sep 2026

Sources

CVE-2007-5416 · NVD

Track software like this

Free during beta