The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_fields.inc, as demonstrated by PHP object injection, involving a field_names object and an Archive_Tar object, for file deletion. Code execution might also be possible.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Views_dynamic_field | Drupal | * | 6.x-1.4 (including) |
| Views_dynamic_field | Drupal | 7.x-1.0-alpha1 (including) | 7.x-1.0-alpha1 (including) |
| Views_dynamic_field | Drupal | 7.x-1.0-alpha2 (including) | 7.x-1.0-alpha2 (including) |
| Views_dynamic_field | Drupal | 7.x-1.0-alpha3 (including) | 7.x-1.0-alpha3 (including) |
| Views_dynamic_field | Drupal | 7.x-1.0-alpha4 (including) | 7.x-1.0-alpha4 (including) |