Executive brief
The Drupal avatar_uploader module, which allows users to upload and crop profile pictures, contains a security flaw. An attacker can trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's web browser. This could lead to the theft of login sessions or sensitive information from the affected website.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the Drupal avatar_uploader module version 7.x-1.0-beta8. The flaw is located in the 'avatar_uploader.pages.inc' file, where the 'file' parameter is improperly neutralized before being rendered in the web page. An unauthenticated remote attacker can exploit this by crafting a URL containing a malicious JavaScript payload. When a victim visits the link, the script executes within the context of their browser session, potentially allowing for session hijacking or unauthorized actions on behalf of the user. Public exploit code is available, but no official patch has been confirmed as the project is not covered by Drupal's security advisory policy.
Affected products
- Drupal avatar_uploader 7.x-1.0-beta8
Timeline
- 2022-03-30: disclosed: Exploit published on Exploit-DB
- 2026-05-10: advisory: CVE published/updated via VulnCheck