Secunia

Some vulnerabilities have been reported in the Taxonomy Autotagger module for Drupal, which can be exploited by malicious users to conduct SQL injection and script insertion attacks.

1) Certain unspecified input when creating or editing posts is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when a malicious page is viewed.

2) Certain unspecified input passed when creating or editing posts is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of the vulnerabilities require permission to create or edit posts.

The vulnerabilities are reported in versions prior to 5.x-1.8.

Solution
Update to version 5.x-1.8.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits:
1) Heine Deelstra of the Drupal security team
2) John Morahan

Changelog
Further details available in Customer Area

Original Advisory
SA-2008-041:
http://drupal.org/node/277877

Deep Links
Links available in Customer Area