Tag1 D7ES Security Advisories

The Popup module doesn't protect several administrative menu callbacks from cross-site request forgery (CSRF), allowing popup format and description configuration to be changed when an authenticated administrator visits an attacker controlled page.

The Helper module's XML parsing utility did not disable external entity loading before parsing user-supplied XML, allowing an attacker to read arbitrary local files from the server via crafted XXE payloads.

The Popup module exposes an anonymous AHAH callback that renders the body of the targeted content without re-checking the current user's access, allowing an anonymous visitor to retrieve content they should not be able to see, such as an unpublished node.

The background image upload form validates uploaded files by extension only, allowing a user to save a non-image file containing an HTML/JavaScript payload to the public files directory where it can be served back to other users.

The `responsive_panels` module's anonymous AJAX pane handler (`responsive-panels/get-panes`) unserializes attacker-supplied `$_POST['panes'][n]['context']` with no authentication, permission, or token check, allowing an unauthenticated attacker to instantiate arbitrary PHP objects (PHP Object Injection) and — with a suitable POP gadget chain — achieve remote code execution.

The Ingenico batch capture page is exposed to every visitor, allowing an unauthenticated user to trigger a capture of all pending Ingenico payment transactions.

When login is disabled with an optional access key, the module places no rate limit on attempts to supply that key in the URL, allowing an unauthenticated attacker to guess it through unlimited automated requests and re-enable the login form.

The Calendar module outputs taxonomy term names and OG group names directly into HTML `title` attributes without sanitization, allowing a user with term or group management permissions to inject arbitrary JavaScript executed in the browser of any visitor viewing a calendar with stripe coloring enabled.

The 3D Secure callback handler never verified the Ingenico SHA signature before trusting the callback, allowing an unauthenticated remote attacker to forge a captured payment and mark an order as paid without any real transaction.

The module's "secret word" check on the account registration form had no rate limiting, allowing an anonymous attacker to repeatedly guess the shared secret word and bypass the spam-prevention gate.