Description
The Node Quick Find module 6.x-1.1 for Drupal does not use db_rewrite_sql when presenting node titles, which allows remote attackers to bypass intended access restrictions and read potentially sensitive node titles via the autocomplete feature.
References
- http://drupal.org/files/issues/db_rewrite_sql_12.patch
- http://drupal.org/node/1118408
- 44046 third-party-advisory
- 47238 vdb-entry
- nodequickfind-dbrewritesql-info-disc(66604) vdb-entry
- http://drupal.org/node/1080114