Drupal Avatar Uploader Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Drupal Avatar Uploader module, specifically in version 7.x-1.0-beta8. This vulnerability allows unauthenticated attackers to inject malicious scripts by manipulating the file parameter in avatar_uploader.pages.inc. Attackers can craft URLs with script payloads that, when accessed, execute arbitrary JavaScript in the context of the victim's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the avatar_uploader.pages.inc endpoint with a file parameter containing a script payload, such as a JavaScript alert. The injected script will be executed in the browser of the user accessing the crafted URL.