Drupal 7.x SQLi RCE (CVE-2014-3704)

Exploits SA-CORE-2014-005 / CVE-2014-3704 Drupageddon in Drupal 7.x before 7.32: unauthenticated SQL injection via crafted array keys on the user login form. Delivers the selected PHP payload via form-cache injection default or the authenticated user-post PHP filter chain. !/usr/bin/env python3 -...

Drupal HTTP Parameter Key/Value SQL Injection

This module exploits the Drupal HTTP Parameter Key/Value SQL Injection aka Drupageddon in order to achieve a remote shell on the vulnerable instance. This module was tested against Drupal 7.0 and 7.31 was fixed in 7.32. Two methods are available to trigger the PHP payload on the target: - set...