Description
The Site Documentation Drupal module 5.x before 5.x-1.8 and 6.x before 6.x-1.1 allows remote authenticated users to gain privileges of other users by leveraging the "access content" permission to list tables and obtain session IDs from the database.
References
- 29242 vdb-entry
- http://drupal.org/node/258547
- site-access-content-info-disclosure(42453) vdb-entry
- ADV-2008-1541 vdb-entry
- 30257 third-party-advisory