Drupal Dashboard Tags and Title HTML Injection Vulnerability
BID:42053
Info
Drupal Dashboard Tags and Title HTML Injection Vulnerability
| Bugtraq ID: | 42053 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 28 2010 12:00AM |
| Updated: | Jul 28 2010 12:00AM |
| Credit: | Greg Knaddison |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Drupal Dashboard Tags and Title HTML Injection Vulnerability
The Dashboard module for Drupal is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
This issue affects Dashboard versions prior to 6.x-2.1.
The Dashboard module for Drupal is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
This issue affects Dashboard versions prior to 6.x-2.1.
Exploit / POC
Drupal Dashboard Tags and Title HTML Injection Vulnerability
Attackers can exploit this issue through a browser.
Attackers can exploit this issue through a browser.
References
Drupal Dashboard Tags and Title HTML Injection Vulnerability
References:
References: