FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

drupal -- PHP code execution vulnerabilities

Affected packages
		drupal	<	4.6.2

Details

VuXML ID	f241641e-f5ea-11d9-a6db-000d608ed240
Discovery	2005-06-29
Entry	2005-07-16

Kuba Zygmunt discovered a flaw in the input validation routines of Drupal's filter mechanism. An attacker could execute arbitrary PHP code on a target site when public comments or postings are allowed.

References

CVE Name	CVE-2005-1921
CVE Name	CVE-2005-2106
URL	http://drupal.org/files/sa-2005-002/advisory.txt