Thursday, July 14, 2016  
3 Popular Drupal Modules Found Vulnerable to Hackers — Patch them All
Just yesterday, I wrote a warning article announcing that Drupal – the popular open source content management system – will release patches for several highly critical Remote Code Execution (RCE) bugs that could allow attackers to fully take over any affected site.

Below are the three separate Drupal modules that affect up to 10,000 websites:

1. RESTful Web Services – a popular module used for creating REST APIs, which is currently installed on at least 5,804 websites.

The vulnerability in RESTWS alters the default page callbacks for entities to provide additional functionality, allowing attackers to "send specially crafted requests resulting in arbitrary PHP execution."

Since anonymous users can exploit this vulnerability and there isn't any mitigating factor, users are advised to patch their websites as soon as possible.

Admins using RESTful Web Services versions 7.x-2.x prior to 7.x-2.6 and versions 7.x-1.x prior to 7.x-1.7 for their Drupal websites are affected and are advised to upgrade to the latest RESTful Web Services releases.

2. Coder – a module used for code analysis, which is currently installed on at least 4,951 sites.

The vulnerability exists in the Coder module that does not properly validate user inputs in a script file that has the PHP extension, allowing a malicious unauthorized user to make requests directly to this file to execute arbitrary code.

To exploit the vulnerability, the Coder module does not even need to be enabled. The presence of the module on the file system and being reachable from the Web are enough for an attacker to exploit this flaw.

Coder module versions 7.x-1.x prior to 7.x-1.3 and versions 7.x-2.x prior to 7.x-2.6 are affected. Admins using the Coder module for Drupal 7.x should upgrade to the latest releases.

3. Webform Multiple File Upload – a module used for collecting files from site visitors, which is currently installed on at least 3,076 sites.

The Webform Multiple File Upload module contains a Remote Code Execution flaw that could allow an attacker to take over any affected site entirely using some specially crafted requests.

Any site visitor could potentially exploit this vulnerability to take several malicious actions on the website, including completely taking over the website and server.

This vulnerability exists in the Webform Multiple File Upload (webform_multifile) module versions 7.x-1.x and is fixed in the latest Webform Multiple File Upload version 7.x-1.4.

Comments

Post a Comment

Popular posts from this blog

100+ Awesome Web Development Tools and Resources

Image
100+ Awesome Web Development Tools and Resources Keshav technosys  |  UPDATED:  JULY 5, 2016 The best and worst thing about being a web developer is that the web is constantly changing. While this is exciting it also means that web developers must always be proactive about learning new techniques or programming languages, adapting to changes, and be willing and eager to accept new challenges. This could include tasks such as adapting existing frameworks to meet business requirements, testing a website to identify technical problems, or optimizing and scaling a site to better perform with the back-end infrastructure.  We thought we would compile a comprehensive list of  web development tools and resources  that can help you be more productive, stay informed, and become a better developer. Web Development Tools and Resources for 2016 A lot fo these web development tools below are ones we use at KeyCDN on a daily basis. We can’t include everything, but here are a couple of o
Read more
Image
FBI 'Double Agent' Pleads Guilty to Selling 'Classified Information' to China   Monday, August 01, 2016     An FBI electronics technician has pleaded guilty to acting as a Chinese secret agent and passing along sensitive information about the Feds to a Chinese government official. Kun Shan "Joey" Chun , 46, admitted in federal court in Manhattan on Monday that he violated his security clearance on several occasions between 2011 and 2016 in an effort to pass on secret information to China in exchange for money. Chun is a 19-year FBI veteran from Brooklyn who was born in China but was employed by the FBI in 1997. His duties with the FBI included " accessing sensitive and, in some instance, classified information ." The g-man, as a double agent, sent confidential government information – including the identity and travel plans of an FBI special agent, the internal structure of the FBI and spying technology used by the Bureau – to a Chi
Read more

facebook marketing ajmer,facebook marketing agency ajmer,facebook marketing companies in ajmer,Facebook marketing company ajmer,facebook marketing company in ajmer,Facebook marketing companies ajmer.

facebook marketing ajmer,facebook marketing agency ajmer,facebook marketing companies in ajmer,Facebook marketing company ajmer,facebook marketing company in ajmer,Facebook marketing companies ajmer. : facebook marketing ajmer,facebook marketing agency ajmer,facebook marketing companies in ajmer,Facebook marketing company ajmer,facebook marketing company in ajmer,Facebook marketing companies ajmer.
Read more