CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 6.0
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: sql injection vulnerability in speedtech organization and resource manager (storm) 5.x before 5.x-1.14 and 6.x before 6.x-1.18, a module for drupal, allows remote authenticated users with storm project access to execute arbitrary sql commands via unspecified vectors. per vendor advisory at: http://drupal.org/node/342246

"versions affected

    * versions of storm for drupal 5.x prior to 5.x-1.14
    * versions of storm for drupal 6.x prior to 6.x-1.18

drupal core is not affected. if you do not use the storm module, there is nothing you need to do.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2009-03-02
Last Modified Date: 2017-08-17