Drupal Mobile Tools Module Multiple Unspecified HTML Injection Vulnerabilities

Bugtraq ID:	53734
Class:	Input Validation Error
CVE:	CVE-2012-2717
Remote:	Yes
Local:	No
Published:	May 30 2012 12:00AM
Updated:	Aug 07 2012 08:52PM
Credit:	Justin Klein Keane
Vulnerable:	Drupal Mobile Tools 6.X-2.2 Drupal Mobile Tools 6.X-2.0
Not Vulnerable:	Drupal Mobile Tools 6.X-2.3

Drupal Mobile Tools Module Multiple Unspecified HTML Injection Vulnerabilities

The Mobile Tools module for Drupal is prone to multiple unspecified HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Mobile Tools 6.x-2.x through versions prior to 6.x-2.3 are vulnerable.

Drupal Mobile Tools Module Multiple Unspecified HTML Injection Vulnerabilities

Attackers can exploit these issues through a browser.

Drupal Mobile Tools Module Multiple Unspecified HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references for details.


Drupal Mobile Tools 6.X-2.2

• Drupal mobile_tools 6.x-2.3
  http://drupal.org/node/1169008

Drupal Mobile Tools 6.X-2.0

• Drupal mobile_tools 6.x-2.3
  http://drupal.org/node/1169008

Drupal Mobile Tools Module Multiple Unspecified HTML Injection Vulnerabilities

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• Mobile Tools Homepage (Drupal)
  
• SA-CONTRIB-2012-088 - Mobile Tools - Cross Site Scripting (XSS) (Drupal)