References https://nvd.nist.gov/vuln/detail/CVE-2018-7602 https://www.drupal.org/sa-core-2018-004 https://github.com/cyberharsh/DrupalCVE-2018-7602 https://blog.csdn.net/Tauil/article/details/126217466 https://avd.aliyun.com/detail?id=AVD-2018-7602 https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/Drupal/%EF%BC%88CVE-2018-7602%EF%BC%89Drupal%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/ https://dgpyone.github.io/2022/02/22/Drupal%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%EF%BC%88CVE-2018-7602%EF%BC%89/ https://www.secrss.com/articles/2380 https://blog.nsfocus.net/cve-2018-7602-drupal/ https://www.exploit-db.com/exploits/44542 https://thehackernews.com/2018/04/drupal-vulnerability-exploit.html
Related VulnerabilitiesPoCCVE-2026-10768: Drupal LocalGov Workflows < 1.6.0 - Information DisclosurePoCCVE-2026-9082: Drupal Core - Anonymous SQL Injection via PostgreSQL Entity QueryDrupal core /jsonapi/node/article SQL 注入漏洞(CVE-2026-9082)PoCdrupal-source-code-disclosure: Drupal - Source Code DisclosurePoCdrupal-directory-listing: Drupal Directory ListingPoCCVE-2021-33829: Drupal 7 CKEditor XSSCVE-2019-6340: Drupal 8 core RESTful Web Services RCEPoCCVE-2014-3704: Drupal SQL InjectionPoCCVE-2018-7600: Drupal - Remote Code ExecutionPoCCVE-2018-7602: Drupal - Remote Code ExecutionPoCCVE-2018-9205: Drupal avatar_uploader v7.x-1.0-beta8 - Local File InclusionPoCCVE-2019-6340: Drupal - Remote Code ExecutionPoCCVE-2024-45440: Drupal 11.x-dev - Full Path Disclosure