CVE-2010-1546

Chaos Tool Suite 6.x <6.x-1.4 - Command Injection

Title source: llm
STIX 2.1

Description

Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with "administer page manager" privileges, to execute arbitrary PHP code via input to a text area, related to (1) the page_manager_page_import_subtask_validate function in page_manager/plugins/tasks/page.admin.inc and (2) the page_manager_handler_import_validate function in page_manager/page_manager.admin.inc.

References (10)

Core 10
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/39884
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2010/May/272
Patch, Vendor Advisory x_refsource_confirm
http://drupal.org/node/803944
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/58723
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/40285
Various Sources x_refsource_misc
http://www.madirish.net/?article=458

Scores

EPSS 0.0138
EPSS Percentile 68.8%

Details

CWE
CWE-94
Status published
Products (5)
chaos_tool_suite_project/ctools 6.x-1.0 (9 CPE variants)
chaos_tool_suite_project/ctools 6.x-1.1
chaos_tool_suite_project/ctools 6.x-1.2
chaos_tool_suite_project/ctools 6.x-1.3
chaos_tool_suite_project/ctools 6.x-1.x dev
Published May 21, 2010
Tracked Since Feb 18, 2026