Dan Wilga

Improperly controlled modification of dynamically-determined object attributes in the Drupal Monster Menus module allows for object injection. Specifically, the RSS Page submodule uses the PHP `unserialize()` function when processing input from the node creation form. This allows an attacker with the "RSS Feed: Create new content" permission to inject PHP objects. Object injection is a condition where untrusted input is passed to a deserialization function, potentially allowing the execution of arbitrary code or manipulation of application logic.

Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize HTML code within the page name when it is displayed in the built-in tree browser. This allows an attacker with the ability to create pages to execute arbitrary JavaScript in the context of a user session. Cross-site Scripting is a flaw where malicious scripts are injected into trusted websites.

The issue is related to the deserialization of untrusted data, which allows object injection. This can potentially enable a remote attacker to execute arbitrary code.

The issue is related to insufficient authorization mechanisms in the Monster Menus module of the Drupal CMS, allowing a remote attacker to disclose protected information and impact the integrity of protected information. This can lead to forceful browsing, where an attacker can access unauthorized areas of the system.

The issue concerns the recycle bin feature in the Monster Menus module for Drupal, which fails to properly remove nodes from view. This allows remote attackers to obtain sensitive information via an unspecified URL pattern.