Unscored severity · published May 17, 2014
CVE-2014-3453
Eval injection vulnerability in the flag_import_form_validate function in includes/flag.export.inc in the Flag module 7.x-3.0, 7.x-3.5, and earlier for Drupal allows remote…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Eval injection vulnerability in the flag_import_form_validate function in includes/flag.export.inc in the Flag module 7.x-3.0, 7.x-3.5, and earlier for Drupal allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area to admin/structure/flags/import. NOTE: this issue could also be exploited by other attackers if the administrator ignores a security warning on the permissions assignment page.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Flag · Flag Module Project
through 7.x-3.5; 7.x-3.0; 7.x-3.0; 7.x-3.0; 7.x-3.0; 7.x-3.0; +7 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3453
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3453
Exploit
http://seclists.org/fulldisclosure/2014/May/44
www.openwall.com
http://www.openwall.com/lists/oss-security/2014/05/12/2
www.securityfocus.com
http://www.securityfocus.com/bid/67318
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1096604
More from Flag
5.4
CVE-2025-14556
XSS in Drupal 7 Flag Module