Secunia

A vulnerability has been reported in the Site Documentation module for Drupal, which can be exploited by malicious people to disclose sensitive information.

The module displays data from arbitrary tables in the database. This can be exploited to e.g. get the session IDs for logged-in users, or retrieve usernames, password hashes, and e-mail addresses from the database.

Successful exploitation requires valid "access content" permissions (normally given to both guests and users).

The vulnerability is reported in all versions prior to 5.x-1.8 and 6.x-1.1.

Solution
Update to version 5.x-1.8 or 6.x-1.1.

Provided and/or discovered by
Nancy Wichmann and the Drupal security team

Changelog
Further details available in Customer Area

Original Advisory
DRUPAL-SA-2008-030:
http://drupal.org/node/258547

Deep Links
Links available in Customer Area