CVE:CVE-2011-4113
CNNVD:CNNVD-201111-116
Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。
Drupal的Views模块6.x-2.13之前版本中存在SQL注入漏洞。由于用户提供的数据在被用于SQL查询前没有经过充分的过滤，攻击者可利用该漏洞访问或修改数据。
solution:Upgrade earl_miles views to a higher version than 6.x-2.12,4.7.x-1.0,4.7.x-1.1,4.7.x-1.2,4.7.x-1.3,4.7.x-1.4,4.7.x-1.4.2,4.7.x-1.6,4.7.x-1.6:beta,4.7.x-1.6:beta2,4.7.x-1.6:beta3,4.7.x-1.6:beta5,4.7.x-1.x:dev,4.7.x1.5,5.x-1.0,5.x-1.1:beta,5.x-1.2:beta1,5.x-1.3:beta1,5.x-1.4:rc1,5.x-1.4-2:rc1,5.x-1.5,5.x-1.6,5.x-1.6:beta,5.x-1.6:beta2,5.x-1.6:beta3,5.x-1.6:beta4,5.x-1.6:beta5,5.x-1.7,5.x-1.8,5.x-1.x:dev,6.x-2.0,6.x-2.0:alpha1,6.x-2.0:alpha2,6.x-2.0:alpha3,6.x-2.0:alpha4,6.x-2.0:alpha5,6.x-2.0:beta1,6.x-2.0:beta2,6.x-2.0:beta3,6.x-2.0:beta4,6.x-2.0:rc1,6.x-2.0:rc2,6.x-2.0:rc3,6.x-2.0:rc4,6.x-2.0:rc5,6.x-2.1,6.x-2.2,6.x-2.3,6.x-2.4,6.x-2.5,6.x-2.6,6.x-2.7,6.x-2.8,6.x-2.9,6.x-2.10,6.x-2.11,6.x-2.x:dev,and avoid the version (,6.x-2.12],4.7.x-1.0,4.7.x-1.1,4.7.x-1.2,4.7.x-1.3,4.7.x-1.4,4.7.x-1.4.2,4.7.x-1.6,4.7.x-1.6:beta,4.7.x-1.6:beta2,4.7.x-1.6:beta3,4.7.x-1.6:beta5,4.7.x-1.x:dev,4.7.x1.5,5.x-1.0,5.x-1.1:beta,5.x-1.2:beta1,5.x-1.3:beta1,5.x-1.4:rc1,5.x-1.4-2:rc1,5.x-1.5,5.x-1.6,5.x-1.6:beta,5.x-1.6:beta2,5.x-1.6:beta3,5.x-1.6:beta4,5.x-1.6:beta5,5.x-1.7,5.x-1.8,5.x-1.x:dev,6.x-2.0,6.x-2.0:alpha1,6.x-2.0:alpha2,6.x-2.0:alpha3,6.x-2.0:alpha4,6.x-2.0:alpha5,6.x-2.0:beta1,6.x-2.0:beta2,6.x-2.0:beta3,6.x-2.0:beta4,6.x-2.0:rc1,6.x-2.0:rc2,6.x-2.0:rc3,6.x-2.0:rc4,6.x-2.0:rc5,6.x-2.1,6.x-2.2,6.x-2.3,6.x-2.4,6.x-2.5,6.x-2.6,6.x-2.7,6.x-2.8,6.x-2.9,6.x-2.10,6.x-2.11,6.x-2.x:dev