CVE-2010-1530

Vulnerability

The Internationalization module for Drupal 6.x (versions prior to 6.x-1.4) contains multiple cross-site scripting (XSS) vulnerabilities in the i18nstrings and i18nblocks submodules. User-defined strings used for block translation and strings translated via the locale interface were not properly filtered before display, allowing injection of arbitrary web script or HTML [1].

Exploitation

An attacker must be an authenticated user with either the 'translate interface' or 'administer blocks' permission. They can insert malicious payloads through strings used in block translation or through the untranslated input field. The injected script executes when other users view the affected translated blocks or strings [1].

Impact

Successful XSS exploitation allows the attacker to execute arbitrary web script or HTML in the context of the victim's browser. This can lead to session hijacking, data theft, or gaining full administrative access if the victim is an administrator [1].

Mitigation

Update to Internationalization 6.x-1.4, released on 2010-04-07, and run the Drupal database update [2]. No workarounds are documented; upgrading is the recommended action [1]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.