This vulnerability exists on Windows, regardless of the type of webserver (Apache, IIS) used.
The Drupal theme system takes URL arguments into account when selecting a template file to use for page rendering. While doing so, it didn’t take into account how Windows arrives at a canonicalized path. This enabled malicious users to include files, readable by the webserver and located on the same volume as Drupal, and to execute PHP contained within those files. For example: If a site has uploads enabled, an attacker may upload a file containing PHP code and cause it to be included on a subsequent request by manipulating the URL used to access the site.
Part of security release SA-CORE-2009-004
This vulnerability affects the following application versions:
- Drupal 6.0
- Drupal 6.1
- Drupal 6.3
- Drupal 6.4
- Drupal 6.5
- Drupal 6.6
- Drupal 6.7
- Drupal 6.8
- Drupal 6.9