Drupal 'Printer, e-mail and PDF versions' Module HTML Injection Vulnerability
BID:34954
Info
Drupal 'Printer, e-mail and PDF versions' Module HTML Injection Vulnerability
| Bugtraq ID: | 34954 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 13 2009 12:00AM |
| Updated: | May 14 2009 07:56PM |
| Credit: | Daniel F. Kudwien |
| Vulnerable: |
Drupal Printer, e-mail and PDF versions 6.x-1.6 Drupal Printer, e-mail and PDF versions 6.x-1.5 Drupal Printer, e-mail and PDF versions 6.x-1.4 Drupal Printer, e-mail and PDF versions 6.x-1.3 Drupal Printer, e-mail and PDF versions 5.x-4.6 Drupal Printer, e-mail and PDF versions 5.x-4.5 Drupal Printer, e-mail and PDF versions 5.x-4.4 Drupal Printer, e-mail and PDF versions 5.x-4.3 |
| Not Vulnerable: |
Drupal Printer, e-mail and PDF versions 6.x-1.7 Drupal Printer, e-mail and PDF versions 5.x-4.7 |
Discussion
Drupal 'Printer, e-mail and PDF versions' Module HTML Injection Vulnerability
The 'Printer, e-mail and PDF versions' module for Drupal is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
The following are affected:
'Printer, e-mail and PDF versions' for Drupal 5.x prior to 5.x-4.7
'Printer, e-mail and PDF versions' for Drupal 6.x prior to 6.x-1.7
http://drupal.org/node/207891
The 'Printer, e-mail and PDF versions' module for Drupal is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
The following are affected:
'Printer, e-mail and PDF versions' for Drupal 5.x prior to 5.x-4.7
'Printer, e-mail and PDF versions' for Drupal 6.x prior to 6.x-1.7
http://drupal.org/node/207891
Exploit / POC
Drupal 'Printer, e-mail and PDF versions' Module HTML Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
Drupal 'Printer, e-mail and PDF versions' Module HTML Injection Vulnerability
Solution:
Vendor updates are available. Please see the references for details.
Solution:
Vendor updates are available. Please see the references for details.
References
Drupal 'Printer, e-mail and PDF versions' Module HTML Injection Vulnerability
References:
References: