exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Drupal Viewfield Module Cross Site Scripting

Drupal Viewfield Module Cross Site Scripting
Posted Feb 26, 2009
Authored by Justin C. Klein Keane

The Drupal Viewfield module suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 9267d6616d0fc1302d9d181ec6b74ad8e01e9cabecd66991e29d3020498227ff

Drupal Viewfield Module Cross Site Scripting

Change Mirror Download
Hash: SHA1

Yes, it's yet another CCK related module with XSS vulnerabilities. It's
lame, but it should be reported since the Drupal security team has
already made an announcement about the issue in these modules. Drupal
security and module maintainer have been notified. Details can also be
found at http://www.lampsecurity.org/node/20.

The Drupal Viewfield module (http://drupal.org/project/viewfield) is
designed to allow the creation of nodes that display views and is
vulnerable to cross site scripting attacks. Version 5.x-1.5 was tested
and found vulnerable, but other versions may be affected. This problem
is related to SA-CORE-2009-002 (http://drupal.org/node/372836). The
problem occurs when an administrator creates a new content type using
CCK and then adds or edits a view field for the new content type. Users
authorized to administer content types can configure this field with
malicious code in the "Help text:" area. Input to this field is not
properly sanitized and JavaScript can be executed while attempting to
create new content that includes the link field, or while configuring
the link field.

Here are the steps involved in reproducing this issue:

1. Log in as a user with 'Administer content types' privilege
2. Click Administer -> Content Types
3. Click 'Add content type'
4. Fill in required text in the Identification, Submission and other
5. Click 'Save content type' button
6. Click 'edit' under the Operations column on the 'Administer' ->
'Content management' screen for the new content type
7. Click 'Add field'
8. Fill in the 'Name' text box in the 'Create new field' fieldset and
select the 'View' radio button
9. Click the 'Create field' button
10. In the next screen (assuming the new field was named 'test' and the
new type was named 'test' this will be in Home > Administer > Content
management > Content types > test) find the 'Widget settings' filedset
11. Under "Help text:" enter <script>alert("xss");</script>
12. Click 'Save field settings' button
13. Click 'configure' under the Operations column for the View field OR
click Create content and then choose the content type you created in
the previous steps to trigger the JavaScript.

- --
Justin C. Klein Keane
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org


Login or Register to add favorites

File Archive:

March 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    13 Files
  • 3
    Mar 3rd
    15 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    31 Files
  • 8
    Mar 8th
    16 Files
  • 9
    Mar 9th
    13 Files
  • 10
    Mar 10th
    9 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    10 Files
  • 14
    Mar 14th
    6 Files
  • 15
    Mar 15th
    17 Files
  • 16
    Mar 16th
    22 Files
  • 17
    Mar 17th
    13 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    16 Files
  • 21
    Mar 21st
    13 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By