Description
The Popup module provides a suite of components for displaying content such as text, nodes, blocks, forms, views and inline PHP inside animated popup overlays.
The Popup filter submodule registers a text filter that parses popup tags out of submitted content and dispatches them to the popup API, and the PHP popup handler passes the value of a tag's php attribute straight to the PHP eval function without checking any permission, so any user who can submit content through a text format on which the Popup filter is enabled can run arbitrary PHP code on the server.
This vulnerability is mitigated by the fact that the popup_filter submodule must be enabled and an administrator must first enable the Popup filter on a text format available to the attacking role, a configuration that is not present by default.
Solution
Install the latest version.
If you use the Popup module for Drupal 7, upgrade to Popup 7.x-1.5:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES