Drupal Invoice Module Multiple Cross Site Request Forgery and Cross Site Scripting Vulnerabilities
BID:74345
Info
Drupal Invoice Module Multiple Cross Site Request Forgery and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 74345 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-4382 CVE-2015-4381 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 25 2015 12:00AM |
| Updated: | Jul 15 2015 12:32AM |
| Credit: | Pere Orga and Matt Vance |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Drupal Invoice Module Multiple Cross Site Request Forgery and Cross Site Scripting Vulnerabilities
The Invoice module for Drupal is prone to multiple cross-site request-forgery and cross-site scripting vulnerabilities.
The attacker can exploit these issues to perform unauthorized actions in the context of a user's session, execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible.
Following versions are vulnerable:
Invoice 6.x-1.x prior to 6.x-1.2
Invoice 7.x-1.x prior to 7.x-1.3
The Invoice module for Drupal is prone to multiple cross-site request-forgery and cross-site scripting vulnerabilities.
The attacker can exploit these issues to perform unauthorized actions in the context of a user's session, execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible.
Following versions are vulnerable:
Invoice 6.x-1.x prior to 6.x-1.2
Invoice 7.x-1.x prior to 7.x-1.3
Exploit / POC
Drupal Invoice Module Multiple Cross Site Request Forgery and Cross Site Scripting Vulnerabilities
An attacker must trick an unsuspecting victim into following a malicious URI to exploit these issues.
An attacker must trick an unsuspecting victim into following a malicious URI to exploit these issues.
Solution / Fix
Drupal Invoice Module Multiple Cross Site Request Forgery and Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Drupal Invoice Module Multiple Cross Site Request Forgery and Cross Site Scripting Vulnerabilities
References:
References:
- Drupal Homepage (Drupal)