BID:32136

Drupal Content Construction Kit Module HTML Injection Vulnerabilities

Info

Drupal Content Construction Kit Module HTML Injection Vulnerabilities

Bugtraq ID:	32136
Class:	Input Validation Error
CVE:	CVE-2008-6229
Remote:	Yes
Local:	No
Published:	Nov 05 2008 12:00AM
Updated:	Apr 16 2015 05:51PM
Credit:	CCK maintainers
Vulnerable:	Drupal Content Construction Kit 6.0-1.0 Drupal Content Construction Kit 5.0-1.9 Drupal Content Construction Kit 5.0-1.8 Drupal Content Construction Kit 5.0-1.7 Drupal Content Construction Kit 5.0-1.6 Drupal Content Construction Kit 5.0-1.5 Drupal Content Construction Kit 5.0-1.4 Drupal Content Construction Kit 5.0-1.3 Drupal Content Construction Kit 5.0-1.2 Drupal Content Construction Kit 5.0-1.1 Drupal Content Construction Kit 5.0-1.0

Not Vulnerable:	Drupal Content Construction Kit 6.0-2.0 Drupal Content Construction Kit 5.0-1.10

Discussion

Drupal Content Construction Kit Module HTML Injection Vulnerabilities

The Content Construction Kit module for Drupal is prone to HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

These issues affect versions *prior to* Content Construction Kit 5.x-1.10 and 6.x-2.0.
http://drupal.org/node/207891

Exploit / POC

Drupal Content Construction Kit Module HTML Injection Vulnerabilities

Attackers can use a browser to exploit this issue.

Solution / Fix

Drupal Content Construction Kit Module HTML Injection Vulnerabilities

Solution:
The vendor has released fixes. Please see the references for more information.

Drupal Content Construction Kit 5.0-1.1