Description
The Block Title Link module lets a site editor attach a link to a block title, storing a URL, a title attribute, a link target and a display flag for each block.
When the core PHP filter module is enabled the module evaluates the stored title link as PHP during block preprocessing, before the link is rendered, so a user who holds the set block title links permission can save a value that contains PHP and have it run in the context of the site on every page where the block appears. The value is saved through the normal block configuration form and the module’s own URL validation does not stop it, because a value that begins with the front page placeholder is accepted verbatim and then handed to the evaluation function.
This vulnerability is mitigated by the fact that the core PHP filter module must be enabled and the set block title links permission must be granted to the attacking role, a configuration that is not present by default.
Solution
Install the latest version.
If you use the Block Title Link module for Drupal 7, upgrade to Block Title Link 7.x-1.6:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES