Drupal Who Bought What|Ubercart Multiple Vulnerabilities
BID:45300
Info
Drupal Who Bought What|Ubercart Multiple Vulnerabilities
| Bugtraq ID: | 45300 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 08 2010 12:00AM |
| Updated: | Dec 08 2010 12:00AM |
| Credit: | mr.baileys, Drupal.org Security Team. Mark Styles |
| Vulnerable: |
Drupal Who Bought What | Ubercart 6.X-2.10 |
| Not Vulnerable: |
Drupal Who Bought What | Ubercart 6.x-2.11 |
Discussion
Drupal Who Bought What|Ubercart Multiple Vulnerabilities
The Who Bought What|Ubercart module for Drupal CMS is prone to an SQL-injection, an HTML-injection, and an information-disclosure vulnerability.
Attackers can exploit these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, inject hostile HTML and script code into vulnerable sections of the application, or steal sensitive information.
Drupal 6.x versions prior to 6.x-2.11 are vulnerable.
The Who Bought What|Ubercart module for Drupal CMS is prone to an SQL-injection, an HTML-injection, and an information-disclosure vulnerability.
Attackers can exploit these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, inject hostile HTML and script code into vulnerable sections of the application, or steal sensitive information.
Drupal 6.x versions prior to 6.x-2.11 are vulnerable.
Exploit / POC
Drupal Who Bought What|Ubercart Multiple Vulnerabilities
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.
Solution / Fix
Drupal Who Bought What|Ubercart Multiple Vulnerabilities
Solution:
The vendor has released an update. Please see the references for more information.
Solution:
The vendor has released an update. Please see the references for more information.
References
Drupal Who Bought What|Ubercart Multiple Vulnerabilities
References:
References:
- Drupal Homepage (Drupal)
- Who Bought What|Ubercart Project Page (Drupal)