Description
The Bad Behavior module analyzes incoming HTTP requests, blocks suspected spam bots, and records each blocked request in a log that administrators review at admin/reports/badbehavior.
The module prints the logged request fields, including the client IP, request method, request URI, server protocol, request headers, user agent, and request entity, directly into its log overview page and event detail page without passing them through an output sanitizer.
This vulnerability is mitigated by the fact that the module already escapes every logged field with db_escape_field() before storage, which strips all characters outside the set of letters, digits, underscore, and period, so the characters needed to inject markup never reach the stored value in a default installation, and viewing the log additionally requires the administer bad behavior permission.
Solution
Install the latest version.
If you use the Bad Behavior module for Drupal 7, upgrade to Bad Behavior 7.x-2.2217:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES