CVE-2008-6383

Drupal Storm < 5.x-1.14 and < 6.x-1.18 - Authenticated SQL Injection

Title source: llm

Description

SQL injection vulnerability in SpeedTech Organization and Resource Manager (Storm) 5.x before 5.x-1.14 and 6.x before 6.x-1.18, a module for Drupal, allows remote authenticated users with storm project access to execute arbitrary SQL commands via unspecified vectors.

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/47077

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/32978

Patch vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/32626

Patch, Vendor Advisory x_refsource_confirm

http://drupal.org/node/342246

Scores

EPSS 0.0026

EPSS Percentile 49.5%

Details

CWE

CWE-89

Status published

Products (33)

drupal/storm 5.x-1.1

drupal/storm 5.x-1.2

drupal/storm 5.x-1.3

drupal/storm 5.x-1.4

drupal/storm 5.x-1.5

drupal/storm 5.x-1.6

drupal/storm 5.x-1.7

drupal/storm 5.x-1.8

drupal/storm 5.x-1.9

drupal/storm 5.x-1.10

... and 23 more

Published Mar 02, 2009

Tracked Since Feb 18, 2026