Tag1 D7ES Security Advisories

The Mass Contact module passed an empty validators array when saving email attachments to the server, allowing authenticated users to upload files of any type and size. Uploaded files are stored in a publicly accessible directory, which may expose the server to stored malicious content.

The Node Form Settings module failed to HTML-escape the node title when inserting it into custom form page titles, allowing a user with content creation permissions to inject arbitrary HTML into the edit and delete node form pages viewed by other users.

The Helper module's XML parsing API accepted user-controlled URLs without validating whether the target address was an internal or reserved network resource, allowing authenticated attackers to make the server issue requests to private infrastructure.

The Mass Contact module fails to sanitize attachment filenames before inserting them into error messages, allowing an attacker with send permissions to inject arbitrary HTML or JavaScript by uploading a file with a crafted filename.

The Simple Package Tracking module exposes four AJAX endpoints for deleting and triggering actions on order tracking numbers, but guarded them only with `user_access('access content')`. Any authenticated user could delete or re-trigger tracking actions on tracking numbers belonging to orders they do not own.

The `_cleantalk_die()` function outputs the CleanTalk API response message directly into HTML without sanitization. An attacker who can influence the CleanTalk cloud API response could inject arbitrary HTML or JavaScript into the page shown to blocked users.

The Boost module failed to exclude pages with a `?destination=` query parameter from its static file cache due to a PHP undefined-variable bug, allowing anonymous visitors to cause such pages to be cached and later served incorrectly to other users.

The SpamFireWall (SFW) "block" page reflects the request URI and the blocked IP address into HTML without sanitization, allowing an attacker to break out of an `href` attribute and execute arbitrary JavaScript in the victim's browser.

The Outline Designer module failed to verify that a target content type was in the site's allowed book types list and that the user had create permission on that type before performing a node type change, allowing authenticated users to change node types beyond their permitted scope.

The Adaptive Image module passes the unvalidated `$style` argument to internal processing code before checking its validity, causing PHP warnings that expose server filesystem paths when an invalid image style is requested. Invalid requests also receive an HTTP 200 OK response instead of 404.