Tag1 D7ES Announcements

The Popup module doesn't restrict evaluation of PHP contained in popup tags, allowing any user who can submit content through a text format with the Popup filter enabled to execute arbitrary PHP code on the server.

The Popup module doesn't protect several administrative menu callbacks from cross-site request forgery (CSRF), allowing popup format and description configuration to be changed when an authenticated administrator visits an attacker controlled page.

The Popup module exposes an anonymous AHAH callback that renders the body of the targeted content without re-checking the current user's access, allowing an anonymous visitor to retrieve content they should not be able to see, such as an unpublished node.

The video upload form accepts poster and thumbnail images using extension based validation only, so a privileged user can store a non-image file bearing an image extension at a public URL.

The Feedback Collect module stores the feedback origin value submitted with each feedback node and later prints it without sanitization in the submitted feedback administration listing and on the feedback node view, allowing a user who can submit feedback to inject arbitrary JavaScript that executes in the browser of any user who views the submitted feedback.

The background image upload form validates uploaded files by extension only, allowing a user to save a non-image file containing an HTML/JavaScript payload to the public files directory where it can be served back to other users.

The Calendar module outputs taxonomy term names and OG group names directly into HTML `title` attributes without sanitization, allowing a user with term or group management permissions to inject arbitrary JavaScript executed in the browser of any visitor viewing a calendar with stripe coloring enabled.

When login is disabled with an optional access key, the module places no rate limit on attempts to supply that key in the URL, allowing an unauthenticated attacker to guess it through unlimited automated requests and re-enable the login form.

The Ingenico batch capture page is exposed to every visitor, allowing an unauthenticated user to trigger a capture of all pending Ingenico payment transactions.

The 3D Secure callback handler never verified the Ingenico SHA signature before trusting the callback, allowing an unauthenticated remote attacker to forge a captured payment and mark an order as paid without any real transaction.