Drupal · Advanced Forum · CVE-2009-2371
**Name of the Vulnerable Software and Affected Versions**
Advanced Forum versions 6.x before 6.x-1.1
**Description**
The issue allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature, as the software does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format.
**Recommendations**
For Advanced Forum versions 6.x before 6.x-1.1, update to version 6.x-1.1 or later to resolve the issue.