Drupal 5.2 drupal_eval _menu[callbacks][1][callback] numeric error

Summaryinfo

A vulnerability, which was classified as critical, has been found in Drupal 5.2. Affected by this vulnerability is the function drupal_eval. The manipulation of the argument _menu[callbacks][1][callback] leads to numeric error. This vulnerability is referenced as CVE-2007-5416. Furthermore, an exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Drupal 5.2 (Content Management System). This issue affects the function drupal_eval. The manipulation of the argument _menu[callbacks][1][callback] with an unknown input leads to a numeric error vulnerability. Using CWE to declare the problem leads to CWE-189. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter s hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupal_eval function through a callback parameter to the default URI, as demonstrated by the _menu[callbacks][1][callback] parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Drupal.

The weakness was published 10/12/2007 as confirmed posting (Bugtraq). It is possible to read the advisory at securityfocus.com. The identification of this vulnerability is CVE-2007-5416 since 10/12/2007. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known.

A public exploit has been developed by ShAnKaR and been published even before and not after the advisory. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (4510). Similar entries are available at VDB-32344, VDB-39247, VDB-39231 and VDB-39230. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Drupal

Version

• 5.2

License

• open-source

Website

• Product: https://www.drupal.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion