CVE-2012-1561 in Finder
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "checkbox and radio button functionalities."
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/10/2026
The CVE-2012-1561 vulnerability represents a critical cross-site scripting flaw within the Drupal content management system's Finder module, affecting versions 6.x-1.x prior to 6.x-1.26 and 7.x-1.x, as well as 7.x-2.x versions before 7.x-2.0-alpha8. This vulnerability specifically targets the module's handling of checkbox and radio button functionalities, creating a pathway for remote attackers to execute malicious code within the context of affected websites. The issue stems from inadequate input validation and output encoding mechanisms within the Finder module's user interface components, where user-provided data fails to be properly sanitized before being rendered back to users.
The technical exploitation of this vulnerability occurs through the manipulation of checkbox and radio button elements within the Finder module's interface, which are commonly used for filtering and selection operations. Attackers can craft malicious payloads that, when processed by the vulnerable module, get executed in the browsers of unsuspecting users who interact with the affected Drupal site. This type of vulnerability falls under the CWE-79 category of Cross-Site Scripting, specifically representing a reflected XSS attack vector where malicious scripts are injected into web pages viewed by other users. The vulnerability's impact is amplified by the fact that it affects core administrative and user interface components, potentially allowing attackers to escalate privileges or steal session cookies.
The operational consequences of this vulnerability extend beyond simple script injection, as it can enable attackers to perform session hijacking, deface websites, steal sensitive information, or redirect users to malicious domains. In a Drupal environment, where the Finder module is often used for content management and user interaction, the attack surface is significant since legitimate users frequently engage with these interface elements. The vulnerability particularly affects organizations relying on Drupal for content management, as it undermines the trust model between users and the web application, potentially leading to complete system compromise if attackers can leverage additional vulnerabilities or gain administrative access.
Mitigation strategies for CVE-2012-1561 require immediate patching of the affected Drupal modules to version 6.x-1.26 or 7.x-2.0-alpha8, respectively, which contain the necessary input sanitization and output encoding fixes. Organizations should also implement proper content security policies and ensure that all user inputs are validated and escaped before rendering in web pages. Network administrators should monitor for suspicious traffic patterns and consider implementing web application firewalls to detect and block potential exploitation attempts. The vulnerability aligns with ATT&CK technique T1566.001 for initial access through malicious web content, making it a critical target for both defensive and offensive security operations. Regular security auditing of Drupal modules and adherence to security best practices, including proper input validation and output encoding, remain essential for preventing similar vulnerabilities in future deployments.