> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Drupal

Drupal's attack surface is smaller and more concentrated than WordPress's, there's no sprawling third-party plugin ecosystem to the same degree, so a lot of value comes from version fingerprinting against known core CVEs rather than hunting for a vulnerable plugin. The other reliable angle, once you have any authenticated access, is Drupal's own module system letting you execute PHP directly through the admin UI.

> **Unauthenticated**
>
> Fingerprinting the version and checking it against known core RCEs (Drupalgeddon-class bugs). No login needed if the version is vulnerable.

> **Authenticated**
>
> With any account that can manage modules and content, the PHP Filter module turns a basic page into direct code execution.

***

## Fingerprinting

Confirming the target is actually Drupal is the first step, `/node/N` pages are a reliable tell since Drupal's node-based content structure is distinctive.

```text theme={null}
http://TARGET.TLD/node/1
http://TARGET.TLD/node/3
```

`CHANGELOG.txt` ships with most Drupal installs by default and states the exact version at the top of the file, the single fastest way to confirm whether a known CVE applies.

```text theme={null}
curl -s http://TARGET.TLD/CHANGELOG.txt
```

***

## Droopescan

Droopescan is a plugin-based CMS scanner that, despite the name, covers several CMSes beyond just Drupal (Silverstripe, WordPress, Joomla, Moodle), you select which one with the subcommand.

```text theme={null}
droopescan scan drupal -u http://TARGET.TLD
```

> [!NOTE]
>
> The `scan drupal` subcommand fingerprints and enumerates **Drupal** specifically, not Joomla, each CMS gets its own subcommand (`scan joomla`, `scan wordpress`, etc.) rather than one generic scan mode.

***

## Known Core RCEs

Drupal's two most infamous vulnerabilities both go by "Drupalgeddon" and both led to mass exploitation shortly after disclosure, worth checking the version against these first.

<table>
  <colgroup>
    <col width="144" />

    <col width="139" />

    <col width="184" />

    <col width="217" />
  </colgroup>

  <thead>
    <tr>
      <th>CVE</th>
      <th>Name</th>
      <th>Affected Versions</th>
      <th>Notes</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>CVE-2014-3704</td>
      <td>Drupalgeddon</td>
      <td>Drupal 7.x before 7.32</td>
      <td>SQL injection in the DB abstraction layer, pre-auth</td>
    </tr>

    <tr>
      <td>CVE-2018-7600</td>
      <td>Drupalgeddon2</td>
      <td>Drupal 7.x before 7.58, 8.x before 8.3.9/8.4.6/8.5.1</td>
      <td>Unauthenticated RCE via Form API render arrays</td>
    </tr>
  </tbody>
</table>

***

## Getting a Shell (Authenticated, pre-Drupal 8)

Drupal's **PHP filter** module lets a page's body contain raw PHP that executes when the page is rendered, removed entirely in Drupal 8+ as a core module (it exists as a contributed module there instead, so check if it's been manually re-added before assuming this won't work).

**1. Enable the PHP filter module**

In the admin dashboard, go to **Modules**, find **PHP filter**, and enable it.

**2. Create a page using it**

Go to **Content → Add content → Basic page**, and set the text format to **PHP code**.

**3. Insert and save your payload**

```php theme={null}
<?php system($_GET['cmd']); ?>
```

Save the page, then visit it with `?cmd=id` appended to the URL to confirm execution.

> [!WARNING]
>
> Because PHP filter is removed from Drupal 8 core, this technique is specific to Drupal 6 and 7 unless the target has deliberately re-added the contributed module. Confirm the version first with `CHANGELOG.txt` before relying on this path.

***

## Quick Reference Tools

> **[Droopescan](https://github.com/SamJoan/droopescan)**
>
> Multi-CMS scanner covering Drupal, Silverstripe, WordPress, Joomla, and Moodle.

> **[Drupal Security Advisories](https://www.drupal.org/security)**
>
> Official source for current Drupal core and module CVEs.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.