Justin C. Klein Keane has reported two vulnerabilities in the HotBlocks module for Drupal, which can be exploited by malicious users to conduct script insertion attacks and cause a DoS (Denial of Service).

1) Certain input related to "block names" is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

2) An error when handling hotblocks recursively embedded in other hotblocks can be exploited to cause a infinite loop and render the site unusable.

Successful exploitation of the vulnerabilities requires the "administer hotblocks" permission.

The vulnerabilities are reported in versions prior to 6.x-1.8.

Solution
Update to version 6.x-1.8.
Further details available to Secunia VIM customers

Provided and/or discovered by
Justin C. Klein Keane

Changelog
Further details available to Secunia VIM customers

Original Advisory
SA-CONTRIB-2012-126:
http://drupal.org/node/1732946

Justin C. Klein Keane:
http://www.madirish.net/543

Deep Links
Links available to Secunia VIM customers