CVE-2026-87938 in CSP log Plugin
Summary
by MITRE • 10/22/2026
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw represents a classic instance of improper neutralization of special elements within database queries, commonly categorized under the Common Weakness Enumeration as CWE-89 SQL Injection. This vulnerability resides specifically within the Drupal CSP log module, affecting all versions from 0.0.0 through 1.0.2. The core technical deficiency lies in the application's failure to properly sanitize or parameterize user-supplied input before incorporating it into an SQL command structure. When a developer constructs dynamic SQL queries by directly concatenating unsanitized variables, they create an execution path that allows malicious actors to inject arbitrary SQL code. In this specific context, the CSP log module likely processes data related to Content Security Policy violations or similar logging mechanisms without adequate validation, treating untrusted input as executable database commands rather than literal string values.
From a technical perspective, the exploitation of this vulnerability typically involves an attacker crafting a specially formatted HTTP request that includes malicious SQL syntax within parameters expected by the CSP log functionality. Because the application does not employ prepared statements or robust escaping mechanisms for these specific inputs, the injected code is executed directly by the underlying database management system. This bypasses intended logical controls and allows the attacker to manipulate query results. The severity of this flaw is compounded by its location in a logging component; while logs are often perceived as read-only data stores, improper handling can still lead to significant compromise if the application performs write operations or complex queries based on these inputs during log processing or reporting generation phases.
The operational impact of exploiting this SQL injection vulnerability extends far beyond simple data leakage. An attacker with sufficient privileges could potentially extract sensitive information from the Drupal database, including user credentials, session tokens, and configuration details that reveal system architecture. More critically, depending on the database engine's capabilities and permissions granted to the web application account, an attacker might execute administrative operations such as modifying or deleting records, which compromises data integrity. In severe cases where the underlying database allows operating system command execution via specific functions like xp_cmdshell in Microsoft SQL Server or similar features in other engines, this vulnerability could lead to full server compromise. This aligns with MITRE ATT&CK techniques related to Data from Information Repositories and potentially Command and Control if used for exfiltration channels.
To mitigate this risk, immediate action is required by upgrading the Drupal CSP log module to a version greater than 1.0.2 where these vulnerabilities have been addressed through code patches that implement proper input validation and parameterized queries. For organizations unable to upgrade immediately due to compatibility constraints or other operational dependencies, temporary mitigations should be implemented at the web server or application firewall level. These measures include deploying Web Application Firewall rules designed to detect and block common SQL injection patterns within HTTP requests targeting the affected module endpoints. Additionally, developers must review any custom code interacting with this module to ensure that all database interactions utilize prepared statements with bound parameters rather than string concatenation for query construction. Regular security audits and static application security testing should be employed to prevent similar flaws in future development cycles, ensuring adherence to secure coding standards such as those outlined by OWASP.