VulnHub-DC1-Writeup

VulnHub-DC1-Writeup "渗透测试实验室报告，记录了从侦察到 root 的完整攻击链。" 🔓 VulnHub — DC-1 Boot-to-Root 靶机 Writeup 难度： 初级–中级 平台： VulnHub 目标： 获取全部 4 个 flag 并实现完整的 root 级攻陷 攻击机系统： Kali Linux（VirtualBox — NAT 网络） 目标机系统： Debian Linux（Drupal 7 CMS） 📌 目录 1. 实验环境搭建 2. 侦察与信息收集 3. 漏洞利用 — 远程代码执行 4. 后渗透 — Shell 稳定化 5. Flag 1 —...

CVE-2018-7600-Drupalgeddon2-RCE

CVE-2018-7600 Drupalgeddon2 — 红队项目 ITSOLERA 网络安全部门 | 攻防安全实习 2026 概述 本项目研究、复现并记录了 CVE-2018-7600 Drupalgeddon2 —— Drupal CMS 中的一个严重（CVSS 9.8）未认证远程代码执行漏洞， 影响 7.58 和 8.5.1（2018 年 3 月发布）之前的版本。 该漏洞存在于 Drupal 的 Form API 中，它在将用户提供的输入合并到表单元素渲染属性之前未能对其进行清理——从而允许攻击者注入 PHP 可调用对象，Render API 随后会执行这些对象。 ⚠️...

cve-2018-7600-drupalgeddon2-lab

CVE-2018-7600 Drupalgeddon2 脆弱性ラボ 脆弱なDrupal 7.56環境をDockerでデプロイし、CVE-2018-7600（Drupalgeddon2）の悪用を実演する教育用ラボです。 このプロジェクトは、実際の脆弱性評価ワークフローをシミュレートし、以下を含みます： 脆弱環境のセットアップ 検出（スキャナー） 悪用（RCE） ペイロード分析 ドキュメント 脆弱性の概要 CVE-2018-7600（Drupalgeddon2）は、Drupal CMSにおける重大なリモートコード実行（RCE）脆弱性です。 この問題はDrupalのForm...

drupalgeddon2-cli

drupalgeddon2-cli Drupalgeddon2 CVE-2018-7600 の概念実証をコマンドラインから再実装したものです。Hack The Box Academy の Attacking Common Applications モジュールに取り組む中で、学習演習として作成しました。 !WARNING 許可されたセキュリティテストおよび教育のみを目的としています。 自身が所有していない、または明示的な書面による許可を得ていないシステムに対して実行することは、多くの法域で違法です。詳細は 法的利用と責任 を参照してください。 !NOTE AI 支援を受けて作成されました。...

CVE-2018-7600

TRAN CONG DANH - SVTT - メンター: LUU VAN LAN - CVE-2018-7600 - 開始日: 26/06/2024. 目次: 1. CVE 概要 2. 前提条件 3. CVE 分析 4. 緩和策 CVE 概要 攻撃者は、calluserfunc 自動実行関数を含む Drupal Form API Ajax リクエストを呼び出す可能性があります。 Drupal 7.58 より前、8.x 8.3.9 より前、8.4.x 8.4.6 より前、8.5.x 8.5.1 より前 前提条件 このラボでは、以下を使用しています: Ubuntu 20.04 PHP 7....

Exploit for Improper Input Validation in Drupal

SAWPOC — CVE-2018-7600 A Python Proof of Concept for CVE-20...

CVE-2026-15735

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapiformfield' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

MiracleLinux 3 : drupal-6.30-1.AXS3 (AXSA:2014-234:01)

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2014-234:01 advisory. Drupal is a free software package that allows an individual or a community of users to easily publish, manage and organize a wide variety of content ...

EUVD-2015-6598

Malware in sbrugna...

EUVD-2022-4500

Malicious code in bioql PyPI...

EUVD-2023-1267

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-25273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow a...

WordPress plugin Contact Form to Any API 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2024-23289 · Unknown · Contact Form To Any Api

Name of the Vulnerable Software and Affected Versions: Contact Form to Any API versions 1.1.8 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by...

BIT-DRUPAL-2020-13663

Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities...

BIT-DRUPAL-2022-25271

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...

BIT-DRUPAL-2022-25278

Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules...

Malicious code in fa-icdc-form-api-bdt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24842401e160323f0909c7f6e561fbaa5cbdb6f3b5e3c0dfe2a4dd0fe1877e5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8457 Malicious code in fa-icdc-form-api-bdt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24842401e160323f0909c7f6e561fbaa5cbdb6f3b5e3c0dfe2a4dd0fe1877e5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-24427 · H3C · H3C Magic R300

Name of the Vulnerable Software and Affected Versions: H3C Magic R300 version R300-2100MV100R004 Description: A stack overflow issue was discovered via the SetAPWifiorLedInfoById interface at the "/goform/aspForm" API endpoint. Recommendations: For H3C Magic R300 version R300-2100MV100R004,...