Tag1 D7ES Announcements

The `responsive_panels` module's anonymous AJAX pane handler (`responsive-panels/get-panes`) unserializes attacker-supplied `$_POST['panes'][n]['context']` with no authentication, permission, or token check, allowing an unauthenticated attacker to instantiate arbitrary PHP objects (PHP Object Injection) and — with a suitable POP gadget chain — achieve remote code execution.

The Ingenico batch capture page is exposed to every visitor, allowing an unauthenticated user to trigger a capture of all pending Ingenico payment transactions.

The 3D Secure callback handler never verified the Ingenico SHA signature before trusting the callback, allowing an unauthenticated remote attacker to forge a captured payment and mark an order as paid without any real transaction.

The Calendar module outputs taxonomy term names and OG group names directly into HTML `title` attributes without sanitization, allowing a user with term or group management permissions to inject arbitrary JavaScript executed in the browser of any visitor viewing a calendar with stripe coloring enabled.

When login is disabled with an optional access key, the module places no rate limit on attempts to supply that key in the URL, allowing an unauthenticated attacker to guess it through unlimited automated requests and re-enable the login form.

The performance-report download and report-generation menu routes are configured with an access callback that unconditionally grants access to every user, silently voiding the permissions those routes were meant to require and allowing an anonymous user to download stored performance-profiling reports.

The `drd_agent` module builds a `.phar` filename from the attacker-controlled `HTTP_X_DRD_VERSION` request header, fetches it over HTTPS, writes it to `temporary://`, and `require_once`s it, all with no authentication, signature, or secret check before the inclusion, allowing an unauthenticated attacker to influence the included path. Because the fetch is over HTTPS from a trusted host, standalone code execution is not achievable; chaining to remote code execution requires an additional precondition (a separate file-write primitive that plants a `.phar`, or compromise of the trusted host).

The Salesforce Suite module did not generate or validate an anti-CSRF `state` token during the OAuth 2.0 authorization handshake, allowing an attacker to forge the authorization callback and bind the Drupal site to an attacker-controlled Salesforce account.

The `favorites` module stored anonymous users' favorites in an unsigned client cookie and unserialized the attacker-controlled cookie body with no restriction on allowed classes, allowing an unauthenticated attacker (on a site where anonymous users may manage favorites) to instantiate arbitrary PHP objects (PHP Object Injection) and, with a suitable POP gadget chain, achieve remote code execution.

The module's "secret word" check on the account registration form had no rate limiting, allowing an anonymous attacker to repeatedly guess the shared secret word and bypass the spam-prevention gate.