Drupal Image Module Unspecified HTML Injection Vulnerability
BID:45557
Info
Drupal Image Module Unspecified HTML Injection Vulnerability
| Bugtraq ID: | 45557 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 23 2010 12:00AM |
| Updated: | Dec 23 2010 12:00AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
Drupal Image 6.X-1.0 Drupal Image 5.X-1.9 Drupal Image 5.X-1.0 |
| Not Vulnerable: |
Drupal Image 6.X-1.1 Drupal Image 5.x-2.0 Drupal Image 5.X-1.10 |
Discussion
Drupal Image Module Unspecified HTML Injection Vulnerability
The Image module for Drupal is prone to an unspecified HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
The following versions are vulnerable:
Image module for Drupal 6.x prior to 6.x-1.1
Image module for Drupal 5.x prior to 5.x-2.0
Image module for Drupal 5.x prior to 5.x-1.10
The Image module for Drupal is prone to an unspecified HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
The following versions are vulnerable:
Image module for Drupal 6.x prior to 6.x-1.1
Image module for Drupal 5.x prior to 5.x-2.0
Image module for Drupal 5.x prior to 5.x-1.10
Exploit / POC
Drupal Image Module Unspecified HTML Injection Vulnerability
Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
Drupal Image Module Unspecified HTML Injection Vulnerability
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
Drupal Image Module Unspecified HTML Injection Vulnerability
References:
References:
- Drupal Homepage (Drupal)
- Drupal Image Module (Drupal)
- SA-CONTRIB-2010-113 - Image - Cross Site Scripting (Drupal)