Description
The BOTCHA Spam Prevention module adds "botcha" challenges to forms,
organized through configurable recipe books.
The module outputs the recipe book title in two places without sanitization: as the
page title on the recipe book edit page, and in the recipe book listing where the raw
title is assigned directly to a render element's markup. In both cases a title
containing HTML or JavaScript is rendered as live markup rather than being escaped, so
it executes when an administrator views the listing or edit page.
This vulnerability is mitigated by the fact that creating or editing recipe books
requires the restricted "administer BOTCHA settings" permission, so the payload
can only be injected — and triggered — by an already-privileged user, limiting the
risk primarily to privilege escalation against another administrator.
Solution
Install the latest version.
If you use the BOTCHA Spam Prevention module for Drupal 7, upgrade to botcha 7.x-3.5:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES