----------------------------------------------------------------------

Secunia customers receive relevant and filtered advisories.
Delivery is done via different channels including SMS, Email, Web,
and https based XML feed.
http://corporate.secunia.com/trial/38/request/

----------------------------------------------------------------------

TITLE:
Drupal Database Administration Module Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA24848

VERIFY ADVISORY:
http://secunia.com/advisories/24848/

CRITICAL:
Less critical

IMPACT:
Hijacking, Cross Site Scripting

WHERE:
>From remote

SOFTWARE:
Drupal Database Admistration (dba) Module 4.x
http://secunia.com/product/13916/

DESCRIPTION:
Some vulnerabilities have been reported in Database Administration
(dba) module, which can be exploited by malicious people to conduct
cross-site scripting and request forgery attacks.

1) The dba module does not properly sanitise the result of various
database queries before returning them to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

2) The dba module does not make proper use of the Drupal Form API,
which can be exploited to perform certain actions via HTTP requests.

This is related to SA22486.

The vulnerabilities are reported in all versions of the 4.7.x-1.*
branch prior to 4.7.x-1.2 and all versions of the 4.6.x-* branch.

SOLUTION:
Update to 4.7.x.-1.2.
http://drupal.org/node/135552

PROVIDED AND/OR DISCOVERED BY:
1) Derek Wright, Drupal Security Team
2) Heine Deelstra, Drupal Security Team

ORIGINAL ADVISORY:
http://drupal.org/node/135549

OTHER REFERENCES:
SA22486:
http://secunia.com/advisories/22486/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------