A vulnerability has been reported in the Drupal LoginToboggan module, which can potentially be exploited by malicious users to conduct script insertion attacks.

Input passed to the username is not properly sanitised before being included in "log out" links. This can potentially be exploited by a malicious user to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

Successful exploitation requires that a user is able to insert Javascript code into the username.

The vulnerability is reported in LoginToboggan Module version 4.7.x-1.0. Other versions may also be affected.

Solution
Drupal 4.7.x:
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Chad Phillips.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://drupal.org/node/158921

Deep Links
Links available to Secunia VIM customers