CVE-2010-2002

Vulnerability

The Wordfilter module for Drupal, versions 5.x before 5.x-1.1 and 6.x before 6.x-1.1, fails to sanitize the list of filtered words and their replacements. This allows a cross-site scripting (XSS) attack via the word list on the administrative interface. The vulnerability is present in the module's admin pages and block display [1].

Exploitation

An attacker must have the "administer words filtered" permission, which is typically granted to trusted site administrators. The attacker can then input arbitrary HTML or JavaScript code into the word list fields. When the list is displayed on admin pages or blocks, the unsanitized input is rendered, executing the injected script in the context of the victim's browser [1].

Impact

Successful exploitation leads to arbitrary script execution in the context of the Drupal site. This can result in full administrative access compromise, as the attacker can steal session cookies, perform actions on behalf of the victim, or deface the site. The vulnerability is rated moderately critical by the Drupal Security Team [1].

Mitigation

The fix is to upgrade to Wordfilter 5.x-1.1 or 6.x-1.1, released on 2010-May-12. These versions wrap the filtered word and replacement word in check_plain to prevent XSS [2][3]. No workaround is available; updating is the recommended solution.