CVE-2015-7876 in Drupal 7 Driver for SQL Server
Summary
by MITRE
The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands vectors involving a module using the db_like function.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/23/2022
The vulnerability identified as CVE-2015-7876 affects the Drupal 7 SQL Server and SQL Azure driver component within the sqlsrv/database.inc file. This flaw exists in versions 7.x-1.x before 7.x-1.4 and represents a critical SQL injection vulnerability that undermines the security of Drupal installations relying on Microsoft SQL Server or SQL Azure databases. The vulnerability stems from improper handling of special characters during database query construction, specifically within the escapeLike function that is responsible for sanitizing input for LIKE operations in database queries.
The technical implementation of this vulnerability occurs when the escapeLike function fails to properly escape certain special characters that have significance in SQL syntax. These characters include the percent sign, underscore, and backslash which are commonly used in SQL LIKE pattern matching operations. When modules within Drupal utilize the db_like function to construct database queries, the inadequate escaping allows malicious input to be interpreted as SQL code rather than literal string data. This creates a direct pathway for attackers to inject arbitrary SQL commands that can be executed against the underlying database system.
The operational impact of this vulnerability is severe and far-reaching for Drupal installations using SQL Server or SQL Azure databases. Attackers can leverage this vulnerability to perform unauthorized database operations including data extraction, modification, or deletion. The remote execution capability means that attackers do not require local system access or direct database credentials to exploit the vulnerability. This allows for the potential compromise of sensitive user data, including authentication credentials, personal information, and business-critical data stored within the database. The vulnerability also enables attackers to escalate privileges within the application and potentially gain full administrative control over the Drupal installation.
The vulnerability maps directly to CWE-89 SQL Injection and aligns with ATT&CK technique T1190 Exploit Public-Facing Application, as it represents a remote code execution vulnerability in a widely deployed web application framework. Organizations using Drupal with SQL Server backends face significant risk without proper mitigation, as this vulnerability can be exploited through various attack vectors including user input fields, API endpoints, or any module that utilizes the db_like function. The impact extends beyond immediate data compromise to include potential lateral movement within network environments where the database server may be accessible to other systems.
Mitigation strategies for this vulnerability include immediate upgrading to Drupal 7.x-1.4 or later versions where the escapeLike function has been properly implemented with comprehensive character escaping. Administrators should also implement proper input validation and sanitization at multiple layers of the application architecture, including web application firewalls and database-level protections. Regular security audits and vulnerability assessments should be conducted to identify similar issues in custom modules or third-party components that may utilize database query construction functions. Additionally, implementing principle of least privilege for database accounts and using prepared statements or parameterized queries where possible can provide additional defense-in-depth measures against similar vulnerabilities.