CVE:CVE-2009-1047
CNNVD:CNNVD-200903-378
Drupal是一款开放源码的内容管理平台。
Drupal所使用的Content Construction Kit、Printer, e-mail and PDF versions、Tasklist和Plus 1模块没有正确地用户提供参数，远程攻击者可以通过向上述模块提交恶意的HTTP或SQL查询请求执行跨站脚本、SQL注入等各种攻击。
solution:Upgrade drupal drupal to a higher version than *; Upgrade drupal print to a higher version than 5.x,5.x-1.0,5.x-1.1,5.x-1.2,5.x-1.x-dev,5.x-2.1,5.x-2.2,5.x-2.x-dev,5.x-3.0,5.x-3.1,5.x-3.2,5.x-3.3,5.x-3.4,5.x-3.5,5.x-3.6,5.x-3.7,5.x-4.0,5.x-4.1,5.x-4.2,5.x-4.3,5.x-4.x:dev,6.x-1.0,6.x-1.0-rc3,6.x-1.0-rc4,6.x-1.0-rc5,6.x-1.0-rc8,6.x-1.0-rc9,6.x-1.1,6.x-1.2,6.x-1.3,6.x-1.4,6.x-1.x-dev,and avoid the version 5.x,5.x-1.0,5.x-1.1,5.x-1.2,5.x-1.x-dev,5.x-2.1,5.x-2.2,5.x-2.x-dev,5.x-3.0,5.x-3.1,5.x-3.2,5.x-3.3,5.x-3.4,5.x-3.5,5.x-3.6,5.x-3.7,5.x-4.0,5.x-4.1,5.x-4.2,5.x-4.3,5.x-4.x:dev,6.x-1.0,6.x-1.0-rc3,6.x-1.0-rc4,6.x-1.0-rc5,6.x-1.0-rc8,6.x-1.0-rc9,6.x-1.1,6.x-1.2,6.x-1.3,6.x-1.4,6.x-1.x-dev