Michael Maturi

The Webform module fails to properly force the download of certain uploaded file types when they are served. In specific site configurations, a file uploaded via a webform can be rendered inline by a browser, leading to cross-site scripting (XSS), where malicious scripts are executed in the victim's browser. Approximately 436,300 instances were identified globally. This issue requires a user with permissions to create or edit webforms to allow the affected file extensions, and a victim must manually open the uploaded file.

The Webform module fails to sufficiently exclude certain format templates from token replacement. This allows an attacker to submit data that is evaluated as template code during the rendering of a submission. Depending on the site configuration and enabled modules, this can result in remote code execution, stored cross-site scripting (XSS), or information disclosure. This issue is mitigated if the webform is not configured with a custom multiple-value item format that includes submission-value tokens. Approximately 436,300 instances were identified globally.

An SQL injection issue exists in the Drupal Geolocation Field module, which provides functionality to store coordinates and supports views and other modules. The problem occurs because one of the views filters does not sufficiently sanitize values when they are exposed to user input. This allows for the improper neutralization of special elements used in an SQL command. The risk is limited to scenarios where a view is configured to use the affected filter and is set to accept user input.

An attacker with appropriate JSON:API write permissions could potentially inject a malicious payload in certain rare circumstances, leading to PHP Object Injection. PHP Object Injection occurs when untrusted input is used to instantiate objects, which can allow an attacker to execute arbitrary code or manipulate application logic. This issue is exploitable only if a site uses an entity reference field type that stores a serialized property and has enabled write access for JSON:API, which is read-only by default.

Drupal core contains a gadget chain, which is a sequence of existing code fragments that can be leveraged during the deserialization of untrusted data. While this issue is not directly exploitable, it can serve as a vector to achieve remote code execution or SQL injection if a separate vulnerability allows an attacker to pass unsafe input to the `unserialize()` function.

An unauthenticated SQL injection flaw exists in the database abstraction API of Drupal Core, specifically within the PostgreSQL `EntityQuery` condition handler. The issue occurs when attacker-controlled PHP array keys, such as `filter[...][condition][value][malicious key]`, are concatenated directly into SQL identifiers without proper sanitization. This vulnerability exclusively affects sites using PostgreSQL databases. Remote anonymous users can exploit this to achieve full database access, exfiltrate sensitive data, escalate privileges to Administrator, and potentially execute arbitrary shell commands on the host server via Remote Code Execution (RCE) if database permissions are misconfigured (e.g., allowing `COPY FROM PROGRAM`). Over 15,000 attack probes against approximately 6,000 sites across 65 countries have been detected, with gaming and financial services being primary targets.

The issue allows for the unrestricted upload of a file with a dangerous type.

The issue allows stored XSS.

An authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct Object Reference (IDOR) issue and retrieve sensitive data.

Name of the Vulnerable Software and Affected Versions: Grandstream GRP261x VoIP phone version 1.0.3.6 (Base) Description: The issue allows Command Injection as root in the administrative web interface of the Grandstream GRP261x VoIP phone. Recommendations: For Grandstream GRP261x VoIP phone version 1.0.3.6 (Base), at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Grandstream GRP261x VoIP phone version 1.0.3.6 (Base) Description: The issue allows for authentication bypass in the administrative web interface of the Grandstream GRP261x VoIP phone. Recommendations: For Grandstream GRP261x VoIP phone version 1.0.3.6 (Base), at the moment, there is no information about a newer version that contains a fix for this vulnerability.