Site Documentation Module for Drupal Database Tables Access Content Permission Information Disclosure

high Nessus Plugin ID 32325

Synopsis

The remote web server contains a PHP application that is affected by an information disclosure vulnerability.

Description

The version of the Site Documentation third-party module for Drupal installed on the remote host allows any user with 'access content' permission to retrieve the contents of arbitrary tables in the application's database. An attacker can exploit this issue to retrieve sensitive information, such as usernames, password hashes, email addresses, and active SESSION IDs.

Solution

Upgrade to Site Documentation 5.x-1.8 / 6.x-1.1 or later.

See Also

https://www.drupal.org/node/258547

Plugin Details

Severity: High

ID: 32325

File Name: drupal_sitedoc_tables_disclosure.nasl

Version: 1.23

Type: remote

Family: CGI abuses

Published: 5/16/2008

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:drupal:drupal, cpe:/a:drupal:site_documentation_module

Required KB Items: www/PHP, installed_sw/Drupal

Exploit Ease: No known exploits are available

Patch Publication Date: 5/14/2008

Vulnerability Publication Date: 5/14/2008

Reference Information

CVE: CVE-2008-2271

BID: 29242

CWE: 264

SECUNIA: 30257