BID:39301

Drupal Views Module Cross Site Scripting and PHP Code Injection Vulnerabilities

Info

Drupal Views Module Cross Site Scripting and PHP Code Injection Vulnerabilities

Bugtraq ID:	39301
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 07 2010 12:00AM
Updated:	May 07 2015 05:15PM
Credit:	Angel Lozano Alcazar, Martin Barbella and Derek Wright
Vulnerable:	Drupal Views 6.x-2.8 Drupal Views 6.x-2.6 Drupal Views 6.x-2.5 Drupal Views 6.x-2.2 Drupal Views 6.X-2.1 Drupal Views 6.x-2.0 Drupal Views 5.x-1.6

Not Vulnerable:	Drupal Views 6.x-2.9 Drupal Views 5.x-1.7

Discussion

Drupal Views Module Cross Site Scripting and PHP Code Injection Vulnerabilities

The Views module for Drupal is prone to multiple cross-site scripting issues and a PHP code-injection issue.

An attacker can exploit the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials. The PHP code injection can be exploited to inject and execute arbitrary malicious PHP code in the context of the webserver process.

The issues affect Views versions prior to 5.x-1.7 and 6.x-2.9.

Exploit / POC

Drupal Views Module Cross Site Scripting and PHP Code Injection Vulnerabilities

Attackers can exploit these issues via a browser.

Solution / Fix

Drupal Views Module Cross Site Scripting and PHP Code Injection Vulnerabilities

Solution:
The vendor released updates to address these issues. Please see the references for more information.

Drupal Views 6.x-2.2