CVE-2008-6170

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Drupal 5.x before version 5.12 and 6.x before version 6.6. The bug is located in the book module, where the title of book pages is not properly escaped before being rendered. This allows authenticated users who have the "create book content" permission or the permission to edit any node in the book hierarchy to inject arbitrary HTML and script code via the book page title field [2].

Exploitation

An attacker must have a valid Drupal account with the necessary permissions (create book content or edit node book hierarchy). The attacker then crafts a malicious title containing JavaScript and creates or edits a book page. When other users view that page, the script executes in the context of their session, potentially allowing further actions such as administrator privilege escalation [2].

Impact

Successful exploitation allows the attacker to inject arbitrary web script or HTML, which can lead to session hijacking, credential theft, or administrative account takeover. The attack is considered a cross-site scripting vulnerability that may lead to the attacker gaining administrator access [2].

Mitigation

Drupal 5.12 and Drupal 6.6, released on 2008-October-22, contain the fix [2]. Users running Drupal 5.x should upgrade to 5.12, and those on 6.x should upgrade to 6.6. Patches (SA-2008-067-5.11.patch and SA-2008-067-6.5.patch) are available for those who cannot upgrade immediately [2].