----------------------------------------------------------------------

Did you know that a change in our assessment rating, exploit code
availability, or if an updated patch is released by the vendor, is
not part of this mailing-list?

Click here to learn more:
http://secunia.com/advisories/business_solutions/

----------------------------------------------------------------------

TITLE:
Drupal Project Module File Upload and Cross-Site Scripting

SECUNIA ADVISORY ID:
SA33438

VERIFY ADVISORY:
http://secunia.com/advisories/33438/

CRITICAL:
Moderately critical

IMPACT:
Cross Site Scripting, System access

WHERE:
>From remote

SOFTWARE:
Drupal Project Module 5.x
http://secunia.com/advisories/product/15375/

DESCRIPTION:
Some vulnerabilities have been reported in the Project module for
Drupal, which can be exploited by malicious people to conduct
cross-site scripting attacks and malicious users to compromise a
vulnerable system.

1) The application fails to validate the types of uploaded files
associated with project releases. This can be exploited to upload
files with arbitrary extensions (e.g. pht, php3, etc.) and execute
arbitrary PHP code on the server.

Successful exploitation of this vulnerability requires a certain
server configuration (e.g. an Apache server with the "mod_mime"
module installed) and requires the "maintain projects" permission.

NOTE: Projects associated with a CVS repository using the CVS
integration module are not affected.

2) Input passed to unspecified parameters is not properly sanitised
before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in the
context of an affected site.

These vulnerabilities are reported in versions prior to 5.x-1.3.

SOLUTION:
Update to version 5.x-1.3.

PROVIDED AND/OR DISCOVERED BY:
Adam Light, Drupal Security team.

ORIGINAL ADVISORY:
SA-CONTRIB-2009-001:
http://drupal.org/node/355672

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------