Phone Field - Critical - SQL Injection - SA-CONTRIB-2019-001

Project: Phone FieldDate: 2019-January-09Security risk: Critical 16∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: SQL InjectionDescription: This module provides a phone field for Drupal 7 that supports the HTML5 tel:-schema.
In an API function that is not used by the module, the name for the phone field is not sufficiently sanitised when using it in database queries.
This vulnerability is mitigated by the fact that it affects an unused function. A site is only vulnerable if it has custom code that uses the phonefield_get_entity_id() function and exposes control over the $field parameter to visitors to the site.
Solution: Install the latest version:

Also see the Phone Field project page.Reported By: 

Fixed By: 

Coordinated By: 

Path to article