CVE-2015-7876

https://notcve.org/view.php?id=CVE-2015-7876

The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the db_like function. La función escapeLike en sqlsrv/database.inc en el controlador de Drupal 7 para SQL Server y SQL Azure 7.x-1.x en versiones anteriores a 7.x-1.4 no escapa adecuadamente ciertos carácteres, lo que permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores que implican un módulo que usa la función db_like. • http://cgit.drupalcode.org/sqlsrv/commit/?id=2ea0da8 https://www.drupal.org/node/2569003 https://www.drupal.org/node/2569005 https://www.drupal.org/node/2569577 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •