[Security-news] SA-CONTRIB-2011-001 - Webform - SQL Injection

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2011-001
  * Project: Webform (third-party module)
  * Version: 6.x
  * Date: 2011-January-10
  * Security risk: Highly critical
  * Exploitable from: Remote
  * Vulnerability: SQL Injection

-------- DESCRIPTION  
---------------------------------------------------------

The contributed webform module provides a webform nodetype. Typical uses for
webform are to create questionnaires, contact or request/register forms,
surveys, polls or a front end to issues tracking systems. The module does not
properly use the database API, leading to an SQL Injection [1] vulnerability
that can easily lead to a malicious user gaining full administrative access.
No permissions are required to exploit this issue. The vulnerability is
exploited in the wild.
-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Webform module 6.x-3.x versions prior to 6.x-3.5

Note: Webform 6.x-2.4 is not affected. Drupal core is not affected. If you do
not use the contributed webform [2] module, there is nothing you need to do.
-------- SOLUTION  
------------------------------------------------------------

Install the latest version:
  * If you use the Webform module for Drupal 6.x upgrade to Webform 6.x-3.5
    [3]

See also the Webform project page [4].
-------- REPORTED BY  
---------------------------------------------------------

The vulnerability was reported publicly.
-------- FIXED BY  
------------------------------------------------------------

  * Nathan Haug (quicksketch) [5]

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
form at http://drupal.org/contact. Learn more about the team and their
policies [6], writing secure code for Drupal [7], and secure configuration
[8] of your site.

[1] http://en.wikipedia.org/wiki/SQL_injection
[2] http://drupal.org/project/webform
[3] http://drupal.org/node/1021180
[4] http://drupal.org/project/webform
[5] http://drupal.org/user/35821
[6] http://drupal.org/security-team
[7] http://drupal.org/writing-secure-code
[8] http://drupal.org/security/secure-configuration