Description
The Popup module lets site builders display nodes, blocks, views, and other content inside interactive popup elements, and it can load a popup's body on demand through an AHAH request. The module registers the menu callback that serves this body with the "access content" permission, so the endpoint is reachable by anonymous users, and the callback rebuilds a handler function name from the request path and renders the requested content from cached attributes without verifying that the current user is allowed to view that content. Because the per type handlers render the target without re-checking access, an anonymous request can disclose the rendered body of restricted content, while an unvalidated type value can trigger a PHP fatal error and the reachable php type allows an anonymous request to invoke server side evaluation.
Solution
Install the latest version.
If you use the Popup module for Drupal 7, upgrade to Popup 7.x-1.5:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES