CVE-2009-1576

Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows user-assisted remote attackers to obtain sensitive information by tricking victims into visiting the front page of the site with a crafted URL and causing form data to be sent to an attacker-controlled site, possibly related to multiple / (slash) characters that are not properly handled by includes/bootstrap.inc, as demonstrated using the search box. NOTE: this vulnerability can be leveraged to conduct cross-site request forgery (CSRF) attacks.

• http://drupal.org/files/sa-core-2009-005/SA-CORE-2009-005-5.16.patchPatch
• http://drupal.org/node/449078Patch, Vendor Advisory
• http://secunia.com/advisories/34948Vendor Advisory
• http://secunia.com/advisories/34950Vendor Advisory
• http://secunia.com/advisories/34980
• http://www.debian.org/security/2009/dsa-1792
• http://www.osvdb.org/54153
• http://www.vbdrupal.org/forum/showthread.php?p=9953#post9953Patch
• http://www.vupen.com/english/advisories/2009/1216Vendor Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00108.htmlPatch
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00133.htmlPatch
• http://drupal.org/files/sa-core-2009-005/SA-CORE-2009-005-5.16.patchPatch
• http://drupal.org/node/449078Patch, Vendor Advisory
• http://secunia.com/advisories/34948Vendor Advisory
• http://secunia.com/advisories/34950Vendor Advisory
• http://secunia.com/advisories/34980
• http://www.debian.org/security/2009/dsa-1792
• http://www.osvdb.org/54153
• http://www.vbdrupal.org/forum/showthread.php?p=9953#post9953Patch
• http://www.vupen.com/english/advisories/2009/1216Vendor Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00108.htmlPatch
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00133.htmlPatch

Published

May 6, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1570Integer overflow in the ReadImage function in plug-ins/file-…
• CVE-2009-1571Use-after-free vulnerability in the HTML parser in Mozilla F…
• CVE-2009-1572The BGP daemon (bgpd) in Quagga 0.99.11 and earlier allows r…
• CVE-2009-1573xvfb-run 1.6.1 in Debian GNU/Linux, Ubuntu, Fedora 10, and p…
• CVE-2009-1574racoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remo…
• CVE-2009-1575Cross-site scripting (XSS) vulnerability in Drupal 5.x befor…
• CVE-2009-1577Multiple stack-based buffer overflows in the putstring funct…
• CVE-2009-1578Multiple cross-site scripting (XSS) vulnerabilities in Squir…
• CVE-2009-1579The map_yp_alias function in functions/imap_general.php in S…
• CVE-2009-1580Session fixation vulnerability in SquirrelMail before 1.4.18…
• CVE-2009-1581functions/mime.php in SquirrelMail before 1.4.18 does not pr…
• CVE-2009-1582Million Dollar Text Links 1.0 does not properly restrict adm…