Drupal Translation Management Module Multiple Cross Site Scripting and SQL Injection Vulnerabilities

Bugtraq ID:	47098
Class:	Input Validation Error
CVE:	CVE-2011-1662 CVE-2011-1663
Remote:	Yes
Local:	No
Published:	Mar 30 2011 12:00AM
Updated:	Apr 13 2015 09:01PM
Credit:	Dave Reid of the Drupal Security Team and Greg Dunlap
Vulnerable:	Drupal Translation Management 6.x-1.21
Not Vulnerable:	Drupal Translation Management 6.x-1.22

Drupal Translation Management Module Multiple Cross Site Scripting and SQL Injection Vulnerabilities

The Translation Management module for Drupal is prone to multiple unspecified cross-site scripting and SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Translation Management 6.x-1.22 are vulnerable.

Drupal Translation Management Module Multiple Cross Site Scripting and SQL Injection Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Drupal Translation Management Module Multiple Cross Site Scripting and SQL Injection Vulnerabilities

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2010-015 - Translation Management - Multiple Vulnerabilities (Drupal)