Drupalgeddon2 Python Exploit (CVE-2018-7600)

This repository contains a Python-based proof-of-concept exploit for the critical remote code execution vulnerability in Drupal, known as Drupalgeddon2 (CVE-2018-7600). This script is designed for educational purposes and for security professionals to use in authorized penetration testing scenarios.

📜 Disclaimer

This tool is intended for legal and ethical purposes only. Using this script on any system without explicit permission from the owner is illegal. The author and contributors are not responsible for any misuse or damage caused by this script. Use at your own risk.

Vulnerability Details

• CVE ID: CVE-2018-7600
• Description: Drupal versions before 7.58, 8.3.9, 8.4.6, and 8.5.1 have a remote code execution vulnerability due to insufficient sanitization of array values in form API (FAPI) AJAX requests. This allows an unauthenticated attacker to execute arbitrary code on the target server.
• Affected Versions:
  • Drupal Core 7.x versions prior to 7.58
  • Drupal Core 8.3.x versions prior to 8.3.9
  • Drupal Core 8.4.x versions prior to 8.4.6
  • Drupal Core 8.5.x versions prior to 8.5.1

✨ Features

• Single or Multiple Targets: Scan a single URL or provide a list of URLs from a file.
• Custom Command Execution: Specify the command to be executed on the target system.
• : Run scans on multiple targets concurrently for faster assessments.