CVE-2015-7876

https://notcve.org/view.php?id=CVE-2015-7876

21 Oct 2015 — The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the db_like function. La función escapeLike en sqlsrv/database.inc en el controlador de Drupal 7 para SQL Server y SQL Azure 7.x-1.x en versiones anteriores a 7.x-1.4 no escapa adecuadamente ciertos carácteres, lo que permite a atacantes remoto... • http://cgit.drupalcode.org/sqlsrv/commit/?id=2ea0da8 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •