VulnHub-DC1-Writeup

VulnHub-DC1-Writeup "ペネトレーションテストラボのWriteup — 偵察からroot権限取得までの攻撃チェーン全体を記録。" 🔓 VulnHub — DC-1 Boot-to-Root Writeup 難易度: 初級～中級 プラットフォーム: VulnHub 目標: 4つのフラグをすべて取得し、完全なroot権限を獲得する 攻撃機OS: Kali Linux（VirtualBox — NATネットワーク） ターゲットOS: Debian Linux（Drupal 7 CMS） 📌 目次 1. ラボ環境 2. 偵察と列挙 3. エクスプロイト — リモートコード実行 ...

CVE-2018-7600-Drupalgeddon2-RCE

CVE-2018-7600 Drupalgeddon2 — Red Team Project ITSOLERA Cybersecurity Department | Offensive Security Internship 2026 개요 이 프로젝트는 CVE-2018-7600 Drupalgeddon2을 연구하고, 재현하며, 문서화합니다. 이는 Drupal CMS에서 발생한 치명적CVSS 9.8 인증 없이 실행 가능한 원격 코드 실행 취약점으로, 2018년 3월에 출시된 7.58 및 8.5.1 이전 버전에 영향을 미칩니다. 이 취약점은 Drupal의...

cve-2018-7600-drupalgeddon2-lab

CVE-2018-7600 Drupalgeddon2 취약점 실습 랩 Docker로 배포된 취약한 Drupal 7.56 환경을 활용하여 CVE-2018-7600Drupalgeddon2 익스플로잇을 시연하는 교육용 실습 랩입니다. 이 프로젝트는 실제 환경과 유사한 취약점 평가 워크플로를 시뮬레이션하며, 다음을 포함합니다: 취약한 환경 구축 탐지스캐너 익스플로잇RCE 페이로드 분석 문서화 취약점 개요 CVE-2018-7600Drupalgeddon2은 Drupal CMS의 치명적인 원격 코드 실행RCE 취약점입니다. 이 문제는...

drupalgeddon2-cli

drupalgeddon2-cli Drupalgeddon2CVE-2018-7600 개념 증명PoC을 명령줄 도구로 다시 작성한 것입니다. Hack The Box Academy의 Attacking Common Applications 모듈을 공부하면서 학습 목적으로 만들었습니다. !WARNING 공인된 보안 테스트 및 교육 전용입니다. 소유하지 않았거나 명시적인 서면 허가를 받지 않은 시스템에 대해 실행하는 것은 대부분의 국가에서 불법입니다. 법적 고지 및 책임 있는 사용을 참조하세요. !NOTE 이 구현물은 AI 지원으로...

CVE-2018-7600

TRAN CONG DANH - SVTT - 멘토: LUU VAN LAN - CVE-2018-7600 - 시작일: 26/06/2024. 목차: 1. CVE summary 2. Prerequisites 3. CVE Analyse 4. Mitigation CVE summary 공격자는 calluserfunc 자동 실행 함수를 포함하는 Drupal Form API Ajax Request를 호출할 수 있습니다. Drupal 7.58 이전 버전, 8.x 8.3.9 이전 버전, 8.4.x 8.4.6 이전 버전, 8.5.x 8.5.1 이전 ...

Exploit for Improper Input Validation in Drupal

SAWPOC — CVE-2018-7600 A Python Proof of Concept for CVE-20...

CVE-2026-15735

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapiformfield' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

MiracleLinux 3 : drupal-6.30-1.AXS3 (AXSA:2014-234:01)

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2014-234:01 advisory. Drupal is a free software package that allows an individual or a community of users to easily publish, manage and organize a wide variety of content ...

EUVD-2015-6598

Malware in sbrugna...

EUVD-2022-4500

Malicious code in bioql PyPI...

EUVD-2023-1267

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-25273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow a...

WordPress plugin Contact Form to Any API 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2024-23289 · Unknown · Contact Form To Any Api

Name of the Vulnerable Software and Affected Versions: Contact Form to Any API versions 1.1.8 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by...

BIT-DRUPAL-2020-13663

Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities...

BIT-DRUPAL-2022-25271

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...

BIT-DRUPAL-2022-25278

Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules...

Malicious code in fa-icdc-form-api-bdt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24842401e160323f0909c7f6e561fbaa5cbdb6f3b5e3c0dfe2a4dd0fe1877e5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8457 Malicious code in fa-icdc-form-api-bdt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24842401e160323f0909c7f6e561fbaa5cbdb6f3b5e3c0dfe2a4dd0fe1877e5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-24427 · H3C · H3C Magic R300

Name of the Vulnerable Software and Affected Versions: H3C Magic R300 version R300-2100MV100R004 Description: A stack overflow issue was discovered via the SetAPWifiorLedInfoById interface at the "/goform/aspForm" API endpoint. Recommendations: For H3C Magic R300 version R300-2100MV100R004,...