View online: https://www.drupal.org/sa-contrib-2019-001

Project: Phone Field [1] Date: 2019-January-09 Security risk: *Critical* 16∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: SQL Injection

Description:  This module provides a phone field for Drupal 7 that supports the HTML5 tel:-schema.

In an API function that is not used by the module, the name for the phone field is not sufficiently sanitised when using it in database queries.

This vulnerability is mitigated by the fact that it affects an unused function. A site is only vulnerable if it has custom code that uses the phonefield_get_entity_id() function and exposes control over the $field parameter to visitors to the site.

Solution:  Install the latest version:

* If you use the phonefield module for Drupal 7.x, upgrade to phonefield 7.x-1.1 [3]

Also see the Phone Field [4] project page.

Reported By:  * Drew Webber [5]

Fixed By:  * Drew Webber [6] * Gisle Hannemyr [7]

Coordinated By:  * Greg Knaddison [8] of the Drupal Security Team * Drew Webber [9]

[1] https://www.drupal.org/project/phonefield [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/phonefield/releases/7.x-1.1 [4] https://www.drupal.org/project/phonefield [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/255969 [7] https://www.drupal.org/user/409554 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/255969