Drupal Printer, e-mail and PDF versions Module Content Title HTML Injection Vulnerability
BID:34545
Info
Drupal Printer, e-mail and PDF versions Module Content Title HTML Injection Vulnerability
| Bugtraq ID: | 34545 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 15 2009 12:00AM |
| Updated: | Apr 16 2009 11:06PM |
| Credit: | Stéphane Corlosquet |
| Vulnerable: |
Drupal Printer, e-mail and PDF versions 6.x-1.4 Drupal Printer, e-mail and PDF versions 6.x-1.3 Drupal Printer, e-mail and PDF versions 5.x-4.4 Drupal Printer, e-mail and PDF versions 5.x-4.3 |
| Not Vulnerable: |
Drupal Printer, e-mail and PDF versions 6.x-1.5 Drupal Printer, e-mail and PDF versions 5.x-4.5 |
Discussion
Drupal Printer, e-mail and PDF versions Module Content Title HTML Injection Vulnerability
The 'Printer, e-mail and PDF versions' module for Drupal is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
Versions prior to 'Printer, e-mail and PDF versions' 5.x-4.5 and 6.x-1.5 are vulnerable.
http://drupal.org/node/207891
The 'Printer, e-mail and PDF versions' module for Drupal is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
Versions prior to 'Printer, e-mail and PDF versions' 5.x-4.5 and 6.x-1.5 are vulnerable.
http://drupal.org/node/207891
Exploit / POC
Drupal Printer, e-mail and PDF versions Module Content Title HTML Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
Drupal Printer, e-mail and PDF versions Module Content Title HTML Injection Vulnerability
Solution:
Updates are available. Contact the vendor for more information.
Drupal Printer, e-mail and PDF versions 5.x-4.4
Drupal Printer, e-mail and PDF versions 5.x-4.3
Drupal Printer, e-mail and PDF versions 6.x-1.3
Drupal Printer, e-mail and PDF versions 6.x-1.4
Solution:
Updates are available. Contact the vendor for more information.
Drupal Printer, e-mail and PDF versions 5.x-4.4
-
Drupal print-5.x-4.5.tar.gz
http://ftp.drupal.org/files/projects/print-5.x-4.5.tar.gz
Drupal Printer, e-mail and PDF versions 5.x-4.3
-
Drupal print-5.x-4.5.tar.gz
http://ftp.drupal.org/files/projects/print-5.x-4.5.tar.gz
Drupal Printer, e-mail and PDF versions 6.x-1.3
-
Drupal print-6.x-1.5.tar.gz
http://ftp.drupal.org/files/projects/print-6.x-1.5.tar.gz
Drupal Printer, e-mail and PDF versions 6.x-1.4
-
Drupal print-6.x-1.5.tar.gz
http://ftp.drupal.org/files/projects/print-6.x-1.5.tar.gz
References
Drupal Printer, e-mail and PDF versions Module Content Title HTML Injection Vulnerability
References:
References: