Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with "administer page manager" privileges, to execute arbitrary PHP code via input to a text area, related to (1) the page_manager_page_import_subtask_validate function in page_manager/plugins/tasks/page.admin.inc and (2) the page_manager_handler_import_validate function in page_manager/page_manager.admin.inc.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://drupal.org/node/803944 - Patch, Vendor Advisory | |
| References | () http://drupalcode.org/viewvc/drupal/contributions/modules/ctools/page_manager/page_manager.admin.inc?r1=1.27.2.9&r2=1.27.2.10 - | |
| References | () http://drupalcode.org/viewvc/drupal/contributions/modules/ctools/page_manager/page_manager.admin.inc?view=log - | |
| References | () http://drupalcode.org/viewvc/drupal/contributions/modules/ctools/page_manager/plugins/tasks/page.admin.inc?r1=1.18.2.6&r2=1.18.2.7 - | |
| References | () http://drupalcode.org/viewvc/drupal/contributions/modules/ctools/page_manager/plugins/tasks/page.admin.inc?view=log - | |
| References | () http://seclists.org/fulldisclosure/2010/May/272 - | |
| References | () http://secunia.com/advisories/39884 - Vendor Advisory | |
| References | () http://www.madirish.net/?article=458 - | |
| References | () http://www.securityfocus.com/bid/40285 - Patch | |
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/58723 - |
Information
Published : 2010-05-21 20:30
Updated : 2024-11-21 01:14
NVD link : CVE-2010-1546
Mitre link : CVE-2010-1546
CVE.ORG link : CVE-2010-1546
JSON object : View
Products Affected
chaos_tool_suite_project
- ctools
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')