CVE:CVE-2015-7876
CNNVD:CNNVD-201510-357
Drupal 7 driver for SQL Server and SQL Azure是Drupal社区的一套提供了对SQL Server和SQL Azure的整合用来让Drupal数据库有多种选择的工具。
Drupal 7 driver for SQL Server and SQL Azure 7.x-1.4之前7.x-1.x版本的sqlsrv/database.inc文件中的‘escapeLike’函数存在SQL注入漏洞，该漏洞源于程序没有充分过滤特定的字符。远程攻击者可利用该漏洞执行任意SQL命令。
solution:Upgrade drupal_7_driver_for_sql_server_and_sql_azure_project drupal_7_driver_for_sql_server_and_sql_azure to a higher version than 7.x-1.0,7.x-1.1,7.x-1.2,7.x-1.3,and avoid the version 7.x-1.0,7.x-1.1,7.x-1.2,7.x-1.3