Drupal Book Block Module V.6.x-1.0-beta1 XSS Vulnerability

[Zach Alexander <zalex () sas upenn edu>]

Hello all,

I have discovered an XSS vulnerability in Drupal's Book Block module.
The Drupal Book Block module (https://drupal.org/project/bookblock)
allows users to create a block on their page that can generate an
individual menu block for each of a site's books. The Book Block module
contains a persistent script injection vulnerability (XSS) on its
administration page that fails to properly sanitize the titles of books.

Because this module is still in beta, the Drupal Security Team will not
support it, so I am releasing it in full disclosure in the public issue
queue as well as on this mailing list.
Here is the link to the full report: https://drupal.org/node/1676948

Thanks everyone!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/