SA-CONTRIB-2009-098 - Zoomify - Cross Site Scripting

The Zoomify module integrates the Zoomify Flash applet into Drupal which can be used to pan and zoom on large images. Images are first preprocessed in order for Zoomify to work. The module fails to sanitize a value in the node title, leading to a Cross Site Scripting (XSS) vulnerability.

Versions affected

• Zoomify module for Drupal 6.x prior to Zoomify 6.x-1.4
• Zoomify module for Drupal 5.x prior to Zoomify 5.x-2.2

Drupal core is not affected. If you do not use the contributed Zoomify module, there is nothing you need to do.

Solution

Upgrade to the latest version:

• If you use Zoomify module for Drupal 6.x upgrade to Zoomify 6.x-1.4
• If you use Zoomify module for Drupal 5.x upgrade to Zoomify 5.x-2.2

Reported by

• Reported by Dylan Wilder-Tack

Fixed by

• Fixed by Karim Ratib, the module maintainer