Date
Severity
Critical
Vulnerability
Arbitrary PHP Code Execution
Affected versions
<7.x-1.5

Description

The Popup module provides a suite of components for displaying content such as text, nodes, blocks, forms, views and inline PHP inside animated popup overlays.

The Popup filter submodule registers a text filter that parses popup tags out of submitted content and dispatches them to the popup API, and the PHP popup handler passes the value of a tag's php attribute straight to the PHP eval function without checking any permission, so any user who can submit content through a text format on which the Popup filter is enabled can run arbitrary PHP code on the server.

This vulnerability is mitigated by the fact that the popup_filter submodule must be enabled and an administrator must first enable the Popup filter on a text format available to the attacking role, a configuration that is not present by default.

Solution

Install the latest version.

If you use the Popup module for Drupal 7, upgrade to Popup 7.x-1.5:


Reported by

Fixed by

  • Tag1 D7ES

Coordinated by

  • Tag1 D7ES