Private Message Module For Drupal Delete User Cross Site Request Forgery Vulnerability

Bugtraq ID:	40287
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 19 2010 12:00AM
Updated:	May 19 2010 12:00AM
Credit:	Peter Wolanin, John Morahan, Dylan Tack, Kieran Lal, Ivo Van Geertruyen, Martin Barbella, Brandon Bergren, George Gongadze
Vulnerable:	Drupal Privatemsg 5.x-1.1
Not Vulnerable:

Private Message Module For Drupal Delete User Cross Site Request Forgery Vulnerability

The Private Message module for Drupal is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions, gain unauthorized access to the affected application, or delete certain data. Other attacks are also possible.

Versions prior to Private Message 6.x are vulnerable. NOTE: Private Message 5.x is no longer supported.

Private Message Module For Drupal Delete User Cross Site Request Forgery Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Private Message Module For Drupal Delete User Cross Site Request Forgery Vulnerability

Solution:
This issue is addressed in the Private Message module for Drupal 6.x versions.

Private Message Module For Drupal Delete User Cross Site Request Forgery Vulnerability

References:

• Privatemsg Homepage (Drupal)
  
• SA-CONTRIB-2010-052 - Multiple vulnerabilities in multiple contributed modules (Drupal)