Drupal Magic Tabs Module PHP Code Execution Vulnerability

Bugtraq ID:	29682
Class:	Input Validation Error
CVE:	CVE-2008-2772
Remote:	Yes
Local:	No
Published:	Jun 11 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	Yuval Hager
Vulnerable:	Drupal Magic Tabs 5.x
Not Vulnerable:	Drupal Magic Tabs 5.x-1.1

Drupal Magic Tabs Module PHP Code Execution Vulnerability

The Drupal Magic Tabs module is prone to a remote PHP code-execution vulnerability.

An attacker can exploit this issue to inject and execute arbitrary malicious PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Versions prior to Magic Tabs 5.x-1.1 are vulnerable.

Drupal Magic Tabs Module PHP Code Execution Vulnerability

Attackers can exploit this issue using a browser.

Drupal Magic Tabs Module PHP Code Execution Vulnerability

Solution:
The vendor released Magic Tabs 5.x-1.1 to address this issue. Please see the references for more information.


Drupal Magic Tabs 5.x

• Drupal magic_tabs-5.x-1.1.tar.gz
  http://ftp.drupal.org/files/projects/magic_tabs-5.x-1.1.tar.gz

Drupal Magic Tabs Module PHP Code Execution Vulnerability

References:

• Magic Tabs (Drupal)
  
• SA-2008-032 - Magic Tabs - Arbitrary code execution (Drupal)