Vulnerable Systems:
* Drupal 4.7.x before Drupal 4.7.9
* Drupal 5.x before Drupal 5.4
The function taxonomy_select_nodes() directly injects variables into SQL queries instead of using placeholders. While taxonomy module itself validates the input passed to taxonomy_select_nodes(), this is a weakness in Drupal core. Several contributed modules, such as taxonomy_menu, ajaxLoader, and ubrowser, directly pass user input to taxonomy_select_nodes(), enabling SQL injection attacks by anonymous users.
Vendor Status:
Drupal issued an update for this vulnerability
