Project: 
Phone Field
Date: 
2019-January-09
Security risk: 
Critical 16∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon
Vulnerability: 
SQL Injection
Description: 

This module provides a phone field for Drupal 7 that supports the HTML5 tel:-schema.

In an API function that is not used by the module, the name for the phone field is not sufficiently sanitised when using it in database queries.

This vulnerability is mitigated by the fact that it affects an unused function. A site is only vulnerable if it has custom code that uses the phonefield_get_entity_id() function and exposes control over the $field parameter to visitors to the site.

Solution: 

Install the latest version:

Also see the Phone Field project page.

Reported By: 
Fixed By: 
Coordinated By: