11–20 of 83 posts
Well that doesn't sound good. Drupal.org itself is still running[1] on the unpatched version 7.3.1 which sends a message of how likely sites are to be updated.
A PoC can be found here: http://pastebin.com/nDwLFV3v
You might ask, when will we learn? Well, the truth is making secure systems is incredibly hard work and often comes at the price of flexibility/usability/programmer productivity. We know how to do it, it's just not easy to incorporate.
how bad is this?
- Exploitable by anyone able to access the site
- No mitigation
- Remote code execution
- Stealthy
- Exploits are in the wild
how bad is this?
It appears to be a pretty serious issue. The SQL injection alone is bad but the ability to run basically any PHP code through callbacks makes the problem that much worse.
how bad is this?
Sure, careful programming would have avoided that, but if the two concept were fundamentally different types, this bug would be impossible.
> Full SQL injection, which results in total control and code execution of Website. Well that doesn't sound good. Drupal.org itself is still running[1] on the unpatched version 7.3.1 which sends a message of how likely sites are to be updated. [1] https://www.drupal.org/CHANGELOG.txt
IMHO this is the direct result of conflating arrays/list and hashes/dictionaries into a single thing on the programming language level. Sure, careful programming would have avoided that, but if the two concept were fundamentally different types, this bug would be impossible.