Description
The Node Form Settings module allows administrators to configure custom page titles for node edit and delete forms using token placeholders such as `!node_title` and `!node_type`.
The module used Drupal's `!variable` placeholder syntax inside `t()`, which inserts replacement values as raw, unescaped HTML. Because `$node->title` is user-controlled, an attacker with permission to create or edit content could craft a node title containing malicious HTML or JavaScript that would be inserted verbatim into the form page title string.
This vulnerability is mitigated by the fact that `drupal_set_title()` applies `check_plain()` by default in standard Drupal configurations, providing a secondary layer of protection; however, custom themes or modules that render the title with `PASS_THROUGH` behavior would remain vulnerable.
Solution
Install the latest version.
If you use the Node and Comments Form Settings module for Drupal 7, upgrade to nodeformsettings 7.x-3.2:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES