Some vulnerabilities have been reported in Database Administration (dba) module, which can be exploited by malicious people to conduct cross-site scripting and request forgery attacks.

1) The dba module does not properly sanitise the result of various database queries before returning them to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) The dba module does not make proper use of the Drupal Form API, which can be exploited to perform certain actions via cross-site request forgeries.

This is related to:
SA22486

The vulnerabilities are reported in all versions of the 4.7.x-1.* branch prior to 4.7.x-1.2 and all versions of the 4.6.x-* branch.

Solution
Update to 4.7.x.-1.2.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Derek Wright, Drupal Security Team
2) Heine Deelstra, Drupal Security Team

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://drupal.org/node/135549

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers