CVE-2009-1738

Vulnerability

The Feed Block module for Drupal 6.x fails to sanitize aggregator item titles before display. Versions 6.x-1.x prior to 6.x-1.1 are affected [1]. The vulnerability exists in the handling of external feed items, where the module does not properly escape output, allowing stored cross-site scripting (XSS) [2].

Exploitation

An attacker must be a remote authenticated user with the "administer news feeds" permission [2]. They can inject arbitrary web script or HTML into aggregator items, which will be executed when other users view the block [2].

Impact

Successful exploitation leads to cross-site scripting, potentially allowing the attacker to gain full administrative access to the Drupal site by stealing session cookies or performing actions on behalf of the victim [2].

Mitigation

Upgrade to Feed Block 6.x-1.1, released on 4 May 2009, which adds check_plain() for titles to prevent XSS [1]. No workaround is available; the module is unsupported as of later versions [1].