While I was doing some cleaning up on my site I noticed that some comments that had been published (and approved by myself) had included a paragraph and a link back to a site that I had not seen earlier. For some reason, it only appears when you're editing a comment.

Essentially, spammers are using "clean-url" class="install" in a div that surrounds their spam content. On further investigation, Black Hat spammers are well aware of this bug in Drupal and are exploiting it left and right: http://www.blackhatworld.com/blackhat-seo/black-hat-seo/268078-free-meth...

Comments

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented

Please see http://drupal.org/node/101494 for this security report.

Status: Active » Closed (outdated)

Automatically closed because Drupal 6 is no longer supported. If the issue verifiably applies to later versions, please reopen with details and update the version.