CVE-2007-6299

CVE-2007-6299 describes multiple SQL injection vulnerabilities affecting Drupal and vbDrupal versions 4.7.x prior to 4.7.9 and 5.x prior to 5.4. These flaws allow remote attackers to execute arbitrary SQL commands by exploiting modules that improperly pass input to the taxonomy_select_nodes function, exemplified by the taxonomy_menu, ajaxLoader, and ubrowser contributed modules. With a CVSS score of 7.5, this vulnerability is considered highly severe, requiring no authentication or complex attack conditions, and potentially leading to full compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion or media coverage surrounding this CVE.