Drupal FAQ Ask Module URI Redirection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	36877
Class:	Input Validation Error
CVE:	CVE-2009-4516
Remote:	Yes
Local:	No
Published:	Oct 29 2009 12:00AM
Updated:	Apr 13 2015 09:06PM
Credit:	Dylan Wilder-Tack
Vulnerable:	Drupal FAQ Ask 6.x-1.x Drupal FAQ Ask 5.x-1.x
Not Vulnerable:	Drupal FAQ Ask 6.x-2.0

Drupal FAQ Ask Module URI Redirection and Cross Site Scripting Vulnerabilities

The FAQ Ask module for Drupal is prone to a remote URI-redirection vulnerability and a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary script or HTML code, steal cookie-based authentication credentials, and conduct phishing attacks. Other attacks may also be possible.

Drupal FAQ Ask Module URI Redirection and Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim into following a malicious URI.

Drupal FAQ Ask Module URI Redirection and Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references for details.

Drupal FAQ Ask Module URI Redirection and Cross Site Scripting Vulnerabilities

References:

• DRUPAL-SA-CONTRIB-2009-087 - FAQ Ask - Multiple Vulnerabilities (Drupal)
  
• faq_ask 6.x-2.0 (Drupal)