{"id":"CVE-2006-2742","aliases":["DSA-1125","EUVD-2006-2741","GHSA-c9jq-ww5c-g3v9"],"status":"published","title":"SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to...","description":"SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) database.pgsql.inc, and (c) database.mysqli.inc.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01444,"percentile":0.73482,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2006-06-01T10:00:00Z","modified":"2026-06-16T22:25:39Z","affected":[{"source":"osv","ecosystem":"Debian:3.1","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-6.1sarge1"}]}],"versions":["4.5.3-2","4.5.3-3","4.5.3-4","4.5.3-5","4.5.3-6"],"bundled":5}],"products":[{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://secunia.com/advisories/20140","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Patch","Vendor Advisory"]},{"url":"http://drupal.org/node/65357","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/18245","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2006/1975","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://www.debian.org/security/2006/dsa-1125","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://secunia.com/advisories/21244","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/435790/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26654","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-2742"},{"url":"https://github.com/advisories/GHSA-c9jq-ww5c-g3v9"}],"sources":{"cve":[{"id":"CVE-2006-2742","description":"SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) database.pgsql.inc, and (c) database.mysqli.inc.","status":"published","published":"2006-06-01T10:00:00Z","modified":"2024-08-07T17:58:51.927Z","updated_at":"2026-11-02T14:33:48.871799Z"}],"euvd":[{"id":"EUVD-2006-2741","description":"SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) database.pgsql.inc, and (c) database.mysqli.inc.","status":"published","published":"2006-06-01T10:00:00Z","modified":"2024-08-07T17:58:51Z","updated_at":"2026-11-03T01:15:59.57229Z"}],"ghsa":[{"id":"GHSA-c9jq-ww5c-g3v9","title":"SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to...","description":"SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) database.pgsql.inc, and (c) database.mysqli.inc.","status":"published","published":"2022-05-01T07:02:00Z","modified":"2023-01-31T05:01:22Z","updated_at":"2026-11-02T14:48:02.863685Z"}],"nvd":[{"id":"CVE-2006-2742","description":"SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) database.pgsql.inc, and (c) database.mysqli.inc.","status":"published","published":"2006-06-01T10:02:00Z","modified":"2026-06-16T22:25:39.547Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:01:03.750605Z"}],"osv":[{"id":"DSA-1125","title":"drupal - several","status":"published","published":"2006-07-26T00:00:00Z","modified":"2026-03-09T01:01:43.438916Z","updated_at":"2026-11-02T15:46:14.285228Z"}]}}