[Security-news] Phone Field - Critical - SQL Injection - SA-CONTRIB-2019-001

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2019-001

Project: Phone Field [1]
Date: 2019-January-09
Security risk: *Critical* 16∕25
AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2]
Vulnerability: SQL Injection

Description: 
This module provides a phone field for Drupal 7 that supports the HTML5
tel:-schema.

In an API function that is not used by the module, the name for the phone
field is not sufficiently sanitised when using it in database queries.

This vulnerability is mitigated by the fact that it affects an unused
function. A site is only vulnerable if it has custom code that uses the
phonefield_get_entity_id() function and exposes control over the $field
parameter to visitors to the site.


Solution: 
Install the latest version:

   * If you use the phonefield module for Drupal 7.x, upgrade to phonefield
     7.x-1.1 [3]

Also see the Phone Field [4] project page.

Reported By: 
   * Drew Webber [5]

Fixed By: 
   * Drew Webber [6]
   * Gisle Hannemyr [7]

Coordinated By: 
   * Greg Knaddison [8] of the Drupal Security Team
   * Drew Webber [9]


[1] https://www.drupal.org/project/phonefield
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/phonefield/releases/7.x-1.1
[4] https://www.drupal.org/project/phonefield
[5] https://www.drupal.org/user/255969
[6] https://www.drupal.org/user/255969
[7] https://www.drupal.org/user/409554
[8] https://www.drupal.org/user/36762
[9] https://www.drupal.org/user/255969