Import CSV Data - Critical - SQL Injection

Description

The Import CSV Data module lets administrators import CSV files into dynamically created database tables and provides an aggregate report block for browsing the imported rows.

The report block reads the requested table name straight from the URL query string and interpolates it into database queries without any validation or whitelisting, so a visitor can name any table in the database and read its contents or inject SQL through the backtick quoted identifier.

This vulnerability is mitigated by the fact that a site administrator must first place and make visible the aggregate report block, which is not enabled by default.

Solution

Install the latest version.

If you use the Import CSV Data module for Drupal 7, upgrade to Import CSV Data 7.x-3.1:

• import_csv_data-7.x-3.1.tar.gz
• import_csv_data-7.x-3.1.zip

Reported by

• Ra Mänd (ram4nd)

Fixed by

• Tag1 D7ES

Coordinated by

• Tag1 D7ES