full-disclosure - Drupal Book Block Module V.6.x-1.0-beta1 XSS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 09 Jul 2012 10:52:46 -0400
From: Zach Alexander <zalex@....upenn.edu>
To: full-disclosure@...ts.grok.org.uk
Subject: Drupal Book Block Module V.6.x-1.0-beta1 XSS
	Vulnerability

Hello all,

I have discovered an XSS vulnerability in Drupal's Book Block module.
The Drupal Book Block module (https://drupal.org/project/bookblock)
allows users to create a block on their page that can generate an
individual menu block for each of a site's books. The Book Block module
contains a persistent script injection vulnerability (XSS) on its
administration page that fails to properly sanitize the titles of books.

Because this module is still in beta, the Drupal Security Team will not
support it, so I am releasing it in full disclosure in the public issue
queue as well as on this mailing list.
Here is the link to the full report: https://drupal.org/node/1676948

Thanks everyone!

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/