RETIRED: Drupal Advanced Help Injection and Export Module HTML Injection Vulnerability
BID:38284
Info
RETIRED: Drupal Advanced Help Injection and Export Module HTML Injection Vulnerability
| Bugtraq ID: | 38284 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 17 2010 12:00AM |
| Updated: | Mar 01 2010 05:32PM |
| Credit: | Justin C. Klein Keane |
| Vulnerable: |
Drupal Advanced Help Injection and Export Module 0 |
| Not Vulnerable: | |
Discussion
RETIRED: Drupal Advanced Help Injection and Export Module HTML Injection Vulnerability
The Advanced Help Injection and Export module for Drupal is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
RETIRED (March 1, 2010): The vendor indicates that this module is an alpha release and should not be used in production environments.
The Advanced Help Injection and Export module for Drupal is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
RETIRED (March 1, 2010): The vendor indicates that this module is an alpha release and should not be used in production environments.
Exploit / POC
RETIRED: Drupal Advanced Help Injection and Export Module HTML Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
RETIRED: Drupal Advanced Help Injection and Export Module HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
RETIRED: Drupal Advanced Help Injection and Export Module HTML Injection Vulnerability
References:
References:
- Advanced Help Injection and Export Homepage (Drupal)
- Re: Drupal Help Injection Module XSS Vulnerability (Mori Sugimoto)