Drupal 10.x < 10.4.10 / 10.5.x < 10.5.10 / 10.6.x < 10.6.9 / 11.1.x < 11.1.10 / 11.2.x < 11.2.12 / 11.3.x < 11.3.10 Drupal Vulnerability (SA-CORE-2026-004)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(315939);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/25");

  script_cve_id("CVE-2026-9082");
  script_xref(name:"IAVA", value:"2026-A-0501");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/05/27");

  script_name(english:"Drupal 10.x < 10.4.10 / 10.5.x < 10.5.10 / 10.6.x < 10.6.9 / 11.1.x < 11.1.10 / 11.2.x < 11.2.12 / 11.3.x < 11.3.10 Drupal Vulnerability (SA-CORE-2026-004) ");

  script_set_attribute(attribute:"synopsis", value:
"A PHP application running on the remote web server is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of Drupal running on the remote web server is 10.x prior to
10.4.10, 10.5.x prior to 10.5.10, 10.6.x prior to 10.6.9, 11.1.x prior to 11.1.10, 11.2.x prior to 11.2.12, or 11.3.x
prior to 11.3.10. It is, therefore, affected by a vulnerability.

  - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
    Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from
    10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12,
    from 11.3.0 before 11.3.10. (CVE-2026-9082)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/sa-core-2026-004");
  script_set_attribute(attribute:"see_also", value:"https://symfony.com/blog/category/security-advisories");
  # https://www.drupal.org/files/issues/2026-05-20/SA-CORE-2026-004-8.9.patch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a60fceaa");
  # https://www.drupal.org/files/issues/2026-05-20/SA-CORE-2026-004-9.5.patch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d618ed34");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/project/drupal/releases/10.4.10");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/project/drupal/releases/10.5.10");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/project/drupal/releases/10.6.9");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/project/drupal/releases/11.1.10");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/project/drupal/releases/11.2.12");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/project/drupal/releases/11.3.10");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/psa-2021-06-29");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/psa-2023-11-01");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Drupal version 10.4.10 / 10.5.10 / 10.6.9 / 11.1.10 / 11.2.12 / 11.3.10 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-9082");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/20");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:drupal:drupal");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("drupal_detect.nasl");
  script_require_keys("installed_sw/Drupal", "Settings/ParanoidReport");
  script_require_ports("Services/www", 80, 443);

  exit(0);
}

include('vcf.inc');
include('http.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var port = get_http_port(default:80, php:TRUE);

var app_info = vcf::get_app_info(app:'Drupal', port:port, webapp:TRUE);

vcf::check_granularity(app_info:app_info, sig_segments:2);

var constraints = [
  { 'min_version' : '10.0', 'fixed_version' : '10.4.10' },
  { 'min_version' : '10.5.0', 'fixed_version' : '10.5.10' },
  { 'min_version' : '10.6.0', 'fixed_version' : '10.6.9' },
  { 'min_version' : '11.1.0', 'fixed_version' : '11.1.10' },
  { 'min_version' : '11.2.0', 'fixed_version' : '11.2.12' },
  { 'min_version' : '11.3.0', 'fixed_version' : '11.3.10' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE,
    flags:{'sqli':TRUE}
);