Security questions related to Drupal.
14
votes
4answers
443 views
What are the security threats of zip file uploads and what preventive actions should be taken?
We have a Drupal application developed for sharing files.
We are allowing zip files to be uploaded by logged in departmental user.
We are using Drupal private file system (outside webroot).
We are ...
7
votes
2answers
375 views
Drupal filters XSS with regexes. What could bypass it?
Drupal filters HTML strings against XSS attacks using regexes: http://api.drupal.org/api/drupal/includes%21common.inc/function/filter_xss/7
However, as a lot of people know, HTML can't be parsed with ...
1
vote
3answers
692 views
How to exploit DRUPAL-SA-CORE-2012-003
I have read the security notices and understand that it "would allow an attacker to reinstall an existing Drupal site with an external database server and then execute custom PHP code". According to ...
