Secunia

Joel Palmius has reported a vulnerability in Mod_Survey, allowing malicious people to conduct code insertion attacks.

Various input isn't properly filtered before it is stored. This can potentially be exploited to insert script or arbitrary SQL code, which will be executed when the administrator reads the extracted data with a viewer such as a browser or insert them in an SQL database.

The vulnerability has been reported in version 3.0.16-pre1 and prior.

Solution
The vulnerability has been fixed in version 3.0.16-pre2 and in unstable branch version 3.2.0-pre4.

Provided and/or discovered by
Joel Palmius

Original Advisory
http://freshmeat.net/redir/modsurvey/17034/url_changelog/CHANGELOG.txt

Deep Links
Links available in Customer Area