vendor:
Drupal
by:
Charles FOL
7.5
CVSS
HIGH
Remote Code Execution
89
CWE
Product Name: Drupal
Affected Version From: Drupal 7.x with Services module installed
Affected Version To: Drupal 7.x with Services module installed
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2017
Drupal 7.x Services Module Remote Code Execution
This exploit allows an attacker to execute arbitrary code on a Drupal 7.x website that has the Services module installed. The exploit takes advantage of a SQL injection vulnerability in the module's code to gain administrative access and then writes a PHP file to the server that can be used to execute arbitrary commands.
Mitigation:
Update to the latest version of the Services module and apply any recommended patches or security updates.