Drupal Bibliography Multiple Input Validation Vulnerabilities

Bugtraq ID:	19441
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 09 2006 12:00AM
Updated:	Aug 09 2006 09:50PM
Credit:	The vendor disclosed these vulnerabilities.
Vulnerable:	Drupal Bibliography Module 4.5
Not Vulnerable:	Drupal Bibliography Module 4.7 Drupal Bibliography Module 4.6

Drupal Bibliography Multiple Input Validation Vulnerabilities

Drupal Bibliography module is prone to multiple input-validation vulnerabilities, incuding multiple cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

Versions prior to 4.6 and 4.7 are vulnerable; other versions may also be affected.

Drupal Bibliography Multiple Input Validation Vulnerabilities

Attackers can exploit these issues via a web client.

Drupal Bibliography Multiple Input Validation Vulnerabilities

Solution:
The vendor has released updated versions to address these issues. Please see the references for more information.

Drupal Bibliography Multiple Input Validation Vulnerabilities

References:

• DRUPAL-SA-2006-015: Multiple vulnerabilities in Bibliography (Drupal)
  
• Vendor Homepage (Drupal)