CVE-2009-2370

Vulnerability

The Advanced Forum module for Drupal versions 5.x before 5.x-1.1 and 6.x before 6.x-1.1 fails to properly sanitize certain arguments obtained from the URL. This allows an attacker to inject arbitrary HTML and script code into forum pages via a crafted URL [1]. The vulnerability is classified as moderately critical [1].

Exploitation

An attacker can craft a malicious URL containing script code in a parameter that is not correctly handled by the module. By enticing a suitably privileged user (e.g., a forum administrator) to visit this URL, the attacker can cause the script to execute in the context of the victim's session [1]. No authentication is required for the attacker to craft the URL, but user interaction (the victim clicking the link) is necessary.

Impact

Successful exploitation allows the attacker to execute arbitrary HTML and script code in the victim's browser, potentially leading to session hijacking, defacement, or privilege escalation. The advisory notes that such an attack may lead to the malicious user gaining administrative access [1].

Mitigation

The issue is fixed in Advanced Forum 5.x-1.1 and 6.x-1.1, released on July 1, 2009 [2][3]. Users should upgrade to these versions immediately. No workarounds are provided in the advisory.