Drupal Association members fund grants that make connections all over the world.
- Advisory ID: DRUPAL-SA-2008-050
- Project: Mailhandler (third-party module)
- Versions: 5.x and 6.x
- Date: 2008-September-17
- Security risk: Critical
- Exploitable from: Remote
- Vulnerability: SQL injection
The Mailhandler module allows users to create or edit nodes and comments via email. One vulnerability was found in the module.
Mailhandler does not properly use the Drupal database API and inserts values from mails directly into queries. This can be exploited to perform SQL Injection attacks. These attacks may lead to a malicious user gaining administrator access.
- Versions of Mailhandler for Drupal 5.x prior to 5.x-1.4
- Versions of Mailhandler for Drupal 6.x prior to 6.x-1.4
Drupal core is not affected. If you do not use the Mailhandler module, there is nothing you need to do.
Install the latest version.
- If you use Mailhandler for Drupal 5.x upgrade to Mailhandler 5.x-1.4
- If you use Mailhandler for Drupal 6.x upgrade to Mailhandler 6.x-1.4
Also see the Mailhandler project page.
- The SQL injection vulnerability was reported by the module maintainer Zohar Stolar.
The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact and by selecting the security issues category.