Drupal Monster Menus Module Security Bypass and Script
Drupal Monster Menus Module Security Bypass and Script Insertion Vulnerabilities
Release Date : 2013-08-08
Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status: Vendor Patch
Drupal Monster Menus Module 6.x
Drupal Monster Menus Module 7.x
Two vulnerabilities have been reported in the Monster Menus module for Drupal, which can be exploited by malicious users to bypass certain security restrictions and conduct script insertion attacks.
1) Input passed via the title when editing page settings is not properly sanitised before being edited the next time. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.
Successful exploitation of this vulnerability requires the permission to add pages to the Monster Menus tree.
This vulnerability is reported in 7.x-1.x versions prior to 7.x-1.13.
2) An error due to the mm_webform submodule not properly restricting access can be exploited to delete webform submissions.
Successful exploitation of this vulnerability requires the permission to read data submitted to that webform.
This vulnerability is reported in 6.x-6.x versions prior to 6.x-6.61 and 7.x-1.x versions prior to 7.x-1.13.
Update to a fixed version.
Provided and/or discovered by:
The vendor credits Five Colleges, Inc. and Jay Dansand
Was this reply helpful? (0) (0)