Drupal Simplenews Statistics Module Multiple Vulnerabilities
BID:36790
Info
Drupal Simplenews Statistics Module Multiple Vulnerabilities
| Bugtraq ID: | 36790 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 21 2009 12:00AM |
| Updated: | Oct 22 2009 03:28PM |
| Credit: | John Pettitt, Dylan Wilder-Tack |
| Vulnerable: |
Drupal Simplenews Statistics 6.x-1.2 |
| Not Vulnerable: |
Drupal Simplenews Statistics 6.x-2.0 |
Discussion
Drupal Simplenews Statistics Module Multiple Vulnerabilities
The Simplenews Statistics module for Drupal is prone to multiple vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage these issues to perform unauthorized actions, modify user profile settings, perform phishing attacks, and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials. Other attacks are also possible.
These issues affect versions prior to Simplenews Statistics 6.x-2.0.
The Simplenews Statistics module for Drupal is prone to multiple vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage these issues to perform unauthorized actions, modify user profile settings, perform phishing attacks, and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials. Other attacks are also possible.
These issues affect versions prior to Simplenews Statistics 6.x-2.0.
Exploit / POC
Drupal Simplenews Statistics Module Multiple Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
Solution / Fix
Drupal Simplenews Statistics Module Multiple Vulnerabilities
Solution:
The vendor has released updates. Please see the references for details.
Drupal Simplenews Statistics 6.x-1.2
Solution:
The vendor has released updates. Please see the references for details.
Drupal Simplenews Statistics 6.x-1.2
-
Drupal simplenews_statistics-6.x-2.0.tar.gz
http://ftp.drupal.org/files/projects/simplenews_statistics-6.x-2.0.tar .gz
References
Drupal Simplenews Statistics Module Multiple Vulnerabilities
References:
References: