Skip to main content
Drupal’s attack surface is smaller and more concentrated than WordPress’s, there’s no sprawling third-party plugin ecosystem to the same degree, so a lot of value comes from version fingerprinting against known core CVEs rather than hunting for a vulnerable plugin. The other reliable angle, once you have any authenticated access, is Drupal’s own module system letting you execute PHP directly through the admin UI.

Unauthenticated

Fingerprinting the version and checking it against known core RCEs (Drupalgeddon-class bugs). No login needed if the version is vulnerable.

Authenticated

With any account that can manage modules and content, the PHP Filter module turns a basic page into direct code execution.

​
Fingerprinting

Confirming the target is actually Drupal is the first step, /node/N pages are a reliable tell since Drupal’s node-based content structure is distinctive.
CHANGELOG.txt ships with most Drupal installs by default and states the exact version at the top of the file, the single fastest way to confirm whether a known CVE applies.

​
Droopescan

Droopescan is a plugin-based CMS scanner that, despite the name, covers several CMSes beyond just Drupal (Silverstripe, WordPress, Joomla, Moodle), you select which one with the subcommand.
The scan drupal subcommand fingerprints and enumerates Drupal specifically, not Joomla, each CMS gets its own subcommand (scan joomla, scan wordpress, etc.) rather than one generic scan mode.

​
Known Core RCEs

Drupal’s two most infamous vulnerabilities both go by “Drupalgeddon” and both led to mass exploitation shortly after disclosure, worth checking the version against these first.
CVENameAffected VersionsNotes
CVE-2014-3704DrupalgeddonDrupal 7.x before 7.32SQL injection in the DB abstraction layer, pre-auth
CVE-2018-7600Drupalgeddon2Drupal 7.x before 7.58, 8.x before 8.3.9/8.4.6/8.5.1Unauthenticated RCE via Form API render arrays

​
Getting a Shell (Authenticated, pre-Drupal 8)

Drupal’s PHP filter module lets a page’s body contain raw PHP that executes when the page is rendered, removed entirely in Drupal 8+ as a core module (it exists as a contributed module there instead, so check if it’s been manually re-added before assuming this won’t work).
1

Enable the PHP filter module

In the admin dashboard, go to Modules, find PHP filter, and enable it.
2

Create a page using it

Go to Content → Add content → Basic page, and set the text format to PHP code.
3

Insert and save your payload

Save the page, then visit it with ?cmd=id appended to the URL to confirm execution.
Because PHP filter is removed from Drupal 8 core, this technique is specific to Drupal 6 and 7 unless the target has deliberately re-added the contributed module. Confirm the version first with CHANGELOG.txt before relying on this path.

​
Quick Reference Tools

Droopescan

Multi-CMS scanner covering Drupal, Silverstripe, WordPress, Joomla, and Moodle.

Drupal Security Advisories

Official source for current Drupal core and module CVEs.