CVE-2007-5593

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vectors that cause settings.php to be modified.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://drupal.org/files/sa-2007-025/SA-2007-025-5.2.patchPatch, Vendor Advisory
http://drupal.org/node/184316Vendor Advisory
http://osvdb.org/39648Broken Link
http://secunia.com/advisories/27290Third Party Advisory
http://secunia.com/advisories/27352Third Party Advisory
http://www.securityfocus.com/bid/26119Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/37265Third Party Advisory, VDB Entry
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00328.htmlThird Party Advisory
http://drupal.org/files/sa-2007-025/SA-2007-025-5.2.patchPatch, Vendor Advisory
http://drupal.org/node/184316Vendor Advisory
http://osvdb.org/39648Broken Link
http://secunia.com/advisories/27290Third Party Advisory
http://secunia.com/advisories/27352Third Party Advisory
http://www.securityfocus.com/bid/26119Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/37265Third Party Advisory, VDB Entry
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00328.htmlThird Party Advisory

Timeline

Published: Oct 19, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-55944.3Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete CVE-2007-55955.1CRLF injection vulnerability in the drupal_goto function in includes/common.inc Drupal 4.7.x before 4.7.8 and 5.x before 5.3 allows remote a CVE-2007-55964.3The core Upload module in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 places the .html extension on a whitelist, which allows remote attack CVE-2007-55974.3The hook_comments API in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 does not pass publication status, which might allow attackers to bypas CVE-2007-55984.3Cross-site scripting (XSS) vulnerability in Weblinks for Drupal 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.8 allows remote attackers to inj CVE-2007-55996.8Multiple PHP remote file inclusion vulnerabilities in awrate 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the toroo CVE-2007-56006.8Incomplete blacklist vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to execute arbitrary PHP code via a CVE-2007-56019.3Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions incl CVE-2007-560210.0Multiple stack-based buffer overflows in SwiftView Viewer before 8.3.5, as used by SwiftView and SwiftSend, allow remote attackers to execut CVE-2007-56039.3Stack-based buffer overflow in the SonicWall SSL-VPN NetExtender NELaunchCtrl ActiveX control before 2.1.0.51, and 2.5.x before 2.5.0.56, al CVE-2007-56047.5Buffer overflow in the ExtractCab function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support be CVE-2007-56059.3Buffer overflow in the GetFileTime function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support b