References https://blog.csdn.net/weixin_64551911/article/details/128355788 https://zhuanlan.zhihu.com/p/446658514 https://github.com/bakery312/Vulhub-Reproduce/blob/main/Drupal%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2018-7602.md https://www.secrss.com/articles/2380 https://wlzx.cug.edu.cn/info/1087/2257.htm https://www.tenablecloud.cn/plugins/nessus/109041 https://cloud.yovole.com/1936.html https://scanv.yunaq.com/news/5c6fe11f6c669529ec022ce5.html https://www.gsdzj.gov.cn/info/1033/12271.htm http://joker-vip.github.io/2021/07/14/Drupal%20Core%208%20PECL%20YAML%20%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%BB%BB%E6%84%8F%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%EF%BC%88CVE-2017-6920%EF%BC%89/ https://blog.topsec.com.cn/drupal-core-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E9%A2%84%E8%AD%A6/ https://ti.qianxin.com/uploads/2018/04/13/730d5fb65011036bda9a26841201a562.pdf https://www.sentinelone.com/vulnerability-database/cve-2020-13664/ https://kylingit.com/blog/sa-core-2019-003-drupal-%E5%86%85%E6%A0%B8%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/ https://cloud.tencent.com/developer/article/1933681 https://blog.csdn.net/limb0/article/details/107119538 https://www.ksyun.com/cms/notice/195.html https://it.ruc.edu.cn/wlaq/36398dcac5874c73969612ce8f1661db.htm https://nvd.nist.gov/vuln/detail/cve-2018-7602 https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/drupal-core-remote-code-execution-cve-2019-6340 https://www.drupal.org/sa-core-2018-002 https://www.exploit-db.com/exploits/44449 https://www.drupal.org/sa-core-2018-004
Related VulnerabilitiesPoCCVE-2026-10768: Drupal LocalGov Workflows < 1.6.0 - Information DisclosurePoCCVE-2026-9082: Drupal Core - Anonymous SQL Injection via PostgreSQL Entity QueryDrupal core /jsonapi/node/article SQL 注入漏洞(CVE-2026-9082)PoCdrupal-source-code-disclosure: Drupal - Source Code DisclosurePoCdrupal-directory-listing: Drupal Directory ListingPoCCVE-2021-33829: Drupal 7 CKEditor XSSCVE-2019-6340: Drupal 8 core RESTful Web Services RCEPoCCVE-2014-3704: Drupal SQL InjectionPoCCVE-2018-7600: Drupal - Remote Code ExecutionPoCCVE-2018-7602: Drupal - Remote Code ExecutionPoCCVE-2018-9205: Drupal avatar_uploader v7.x-1.0-beta8 - Local File InclusionPoCCVE-2019-6340: Drupal - Remote Code ExecutionPoCCVE-2024-45440: Drupal 11.x-dev - Full Path Disclosure