header-logo
Suggest Exploit
vendor:
Drupal
by:
SecurityFocus
7.5
CVSS
HIGH
Cross-site Scripting
79
CWE
Product Name: Drupal
Affected Version From: Drupal 4.0
Affected Version To: Drupal 4.0.2
Patch Exists: YES
Related CWE: CVE-2002-1317
CPE: o:drupal:drupal
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2002

Problems with Drupal

Drupal fails to sufficiently filter potentially malicious HTML code from news posts, allowing an attacker to execute arbitrary script code in a vulnerable client. This can be done by inserting malicious HTML code, such as an IMG tag with a JavaScript alert, into a news post.

Mitigation:

Drupal should be configured to filter out potentially malicious HTML code from news posts.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5801/info

Problems with Drupal could allow an attacker to execute arbitrary script code in a vulnerable client.

Drupal fails to sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in their browser. This will occur in the context of the site running the Drupal software. 

<IMG SRC="javascript:alert('unsecure')">

Navigation

Suggest Exploit

Services By CQR