Description
The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines."
References
- http://www.vbdrupal.org/forum/showthread.php?t=786
- 22306 vdb-entry
- 23960 third-party-advisory
- ADV-2007-0406 vdb-entry
- 32136 vdb-entry
- ADV-2007-0415 vdb-entry
- drupal-commentformaddpreview-code-execution(31940) vdb-entry
- http://drupal.org/node/113935
- 20070129 [DRUPAL-SA-2007-005] Drupal 4.7.6 / 5.1 fixes arbitrary code execution issue mailing-list
- 23990 third-party-advisory