Hello all, I have discovered an XSS vulnerability in Drupal's Book Block module. The Drupal Book Block module (https://drupal.org/project/bookblock) allows users to create a block on their page that can generate an individual menu block for each of a site's books. The Book Block module contains a persistent script injection vulnerability (XSS) on its administration page that fails to properly sanitize the titles of books.
Because this module is still in beta, the Drupal Security Team will not support it, so I am releasing it in full disclosure in the public issue queue as well as on this mailing list. Here is the link to the full report: https://drupal.org/node/1676948 Thanks everyone!
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
