CVE-2018-7602

🗓️ 19 Jul 2018 17:00:00Reported by drupalType

cve🔗 web.nvd.nist.gov👁 1295 Views🌐 WEB

Drupal 7.x and 8.x multiple subsystems remote code execution vulnerability - Highly critical

Reporter	Title	Published	Views	Family All 106
zdt	Drupal < 7.58 - drupalgeddon3 Authenticated Remote Code Execution (PoC) Exploit	26 Apr 201800:00	–	zdt
zdt	Drupal < 7.58 - Drupalgeddon3 Authenticated Remote Code Exploit	1 May 201800:00	–	zdt
IBM Security Bulletins	Security Bulletin: API Connect Developer Portal is affected by a Drupal vulnerability (CVE-2018-7602)	15 Jun 201807:09	–	ibm
Gitee	Exploit for Code Injection in Drupal	24 Jul 202114:28	–	gitee
GithubExploit	Exploit for Improper Input Validation in Drupal	17 Apr 201815:38	–	githubexploit
GithubExploit	Exploit for Code Injection in Drupal	27 Apr 201801:59	–	githubexploit
attackerkb	Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004	19 Jul 201800:00	–	attackerkb
AlpineLinux	CVE-2018-7602	19 Jul 201817:00	–	alpinelinux
ArchLinux	[ASA-201804-10] drupal: arbitrary command execution	27 Apr 201800:00	–	archlinux
BDU FSTEC	The vulnerability of the Drupal CMS system’s kernel, related to improper code generation, allows attackers to execute arbitrary code.	3 Apr 202600:00	–	bdu_fstec

NVD

Vulners

Node

drupal drupalRange7.0–7.59

drupal drupalRange8.4.0–8.4.8

drupal drupalRange8.5.0–8.5.3

Node

debian debian_linuxMatch7.0

debian debian_linuxMatch8.0

debian debian_linuxMatch9.0

[
  {
    "defaultStatus": "unaffected",
    "product": "core",
    "vendor": "Drupal",
    "versions": [
      {
        "lessThan": "7.59",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "8.5.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "8.4.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
securityfocus	www.securityfocus.com/bid/103985
exploit-db	www.exploit-db.com/exploits/44542/
securitytracker	www.securitytracker.com/id/1040754
debian	www.debian.org/security/2018/dsa-4180
lists	www.lists.debian.org/debian-lts-announce/2018/04/msg00030.html
exploit-db	www.exploit-db.com/exploits/44557/
drupal	www.drupal.org/sa-core-2018-004
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
q	query param	/?q=node/99/delete&destination=node?q[%2523][]=passthru%26q[%2523type]=markup%26q[%2523markup]=whoami	Remote code execution via crafted q parameter in Drupal core; uses nested payload to execute system commands (e.g., whoami) during a delete form flow.	CWE-94
form_build_id	path	/drupal/?q=file/ajax/actions/cancel/%23options/path/[FORM_BUILD_ID]	Second-stage exploit for Drupal RCE (CVE-2018-7602) using the path-based q parameter and form_build_id to trigger arbitrary code execution.	CWE-94

02 Oct 2026 14:54Current

7.4High risk

Vulners AI Score7.4

CVSS 27.5

CVSS 3.18.1 - 9.8

EPSS0.99172

SSVC