Tag1 D7ES Security Advisories

The Simple Package Tracking module exposes four AJAX endpoints for deleting and triggering actions on order tracking numbers, but guarded them only with `user_access('access content')`. Any authenticated user could delete or re-trigger tracking actions on tracking numbers belonging to orders they do not own.

The Helper module's XML parsing API accepted user-controlled URLs without validating whether the target address was an internal or reserved network resource, allowing authenticated attackers to make the server issue requests to private infrastructure.

The Mass Contact module fails to sanitize attachment filenames before inserting them into error messages, allowing an attacker with send permissions to inject arbitrary HTML or JavaScript by uploading a file with a crafted filename.

The Mass Contact module passed an empty validators array when saving email attachments to the server, allowing authenticated users to upload files of any type and size. Uploaded files are stored in a publicly accessible directory, which may expose the server to stored malicious content.

The SpamFireWall (SFW) "block" page reflects the request URI and the blocked IP address into HTML without sanitization, allowing an attacker to break out of an `href` attribute and execute arbitrary JavaScript in the victim's browser.

The Boost module failed to exclude pages with a `?destination=` query parameter from its static file cache due to a PHP undefined-variable bug, allowing anonymous visitors to cause such pages to be cached and later served incorrectly to other users.

The Outline Designer module failed to verify that a target content type was in the site's allowed book types list and that the user had create permission on that type before performing a node type change, allowing authenticated users to change node types beyond their permitted scope.

The `_cleantalk_die()` function outputs the CleanTalk API response message directly into HTML without sanitization. An attacker who can influence the CleanTalk cloud API response could inject arbitrary HTML or JavaScript into the page shown to blocked users.

The Adaptive Image module passes the unvalidated `$style` argument to internal processing code before checking its validity, causing PHP warnings that expose server filesystem paths when an invalid image style is requested. Invalid requests also receive an HTTP 200 OK response instead of 404.

The Friendly Register module exposed unauthenticated AJAX endpoints for checking username and email availability without CSRF token validation, allowing any external site or script to enumerate valid usernames and email addresses on the Drupal site.