CSP log
The module does not properly clean up user input before using it to search the database. An administrator could run malicious database commands to read any private information and change some data.
- Who could do thisOnly someone with an administrator login.
- Does it apply to youA site is affected if an attacker has the access right to view the security reports.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.
Tell your developerUpdate CSP log to 1.0.2.
For developers: what the fix changed
The fix updates the database query in src/CspLogService.php to use parameterised queries and integer casting for the minimum and maximum amount filters instead of concatenating them directly into the having clause.
Also in this release The release also fixes a bug where the maximum amount filter was incorrectly using the date filter value.
src/CspLogService.php+2 −2 fix