CVE-2008-4633

Drupal Node Clone - Authenticated SQL Injection via Previously Cast Vote

Title source: llm
STIX 2.1

Description

SQL injection vulnerability in Node Vote 5.x before 5.x-1.1 and 6.x before 6.x-1.0, a module for Drupal, when "Allow user to vote again" is enabled, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to a "previously cast vote."

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/31779
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/45920
Vendor Advisory x_refsource_confirm
http://drupal.org/node/321685
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32276

Scores

EPSS 0.0026
EPSS Percentile 49.5%

Details

CWE
CWE-89
Status published
Products (7)
drupal/node_clone 4.7.x-1.0
drupal/node_clone 4.7.x-1.1
drupal/node_clone 4.7.x-1.2
drupal/node_clone 4.7.x-1.3
drupal/node_clone 4.7.x-2.1
drupal/node_clone 5
drupal/node_clone 6
Published Oct 21, 2008
Tracked Since Feb 18, 2026