drupal: does not sanitize data from non-form sources leads to arbitrary PHP code execution
CVSS score
9.8
EPSS probability
%92.0
Risk score
18.0
Published
7 y ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
This exploit is based on CVE-2019-6340 and was built upon the original exploit by leonjza and the Metasploit module, extending it can be executed multiple times against the same target without waiting for cache expiration.
Sumitpathania03/Drupal-cve-2019-6340
(CVE-2019-6340, CVE-2018-7600) drupal8-REST-RCE
Drupal8's REST RCE, SA-CORE-2019-003, CVE-2019-6340
Bits generated while analyzing CVE-2019-6340 Drupal RESTful RCE
Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)
Drupal < 8.6.9 - REST Module Remote Code Execution
Drupal < 8.6.10 / < 8.5.11 - REST Module Remote Code Execution
Nuclei: Drupal - Remote Code Execution
Similar Vulnerabilities
drupal: Unsanitized requests allow remote attackers to execute arbitrary code
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Cross-site scripting in Jqueryui Jquery UI
Cross-site scripting in Jqueryui Jquery UI
Cross-site scripting in Jqueryui Jquery UI
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2019-6340"