.. / CVE-2019-6340

Exploit for Drupal - Remote Code Execution (CVE-2019-6340)

Description:

Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10 V contain certain field types that do not properly sanitize data from non-form sources, which can lead to arbitrary PHP code execution in some cases.

Nuclei Template

View the template here CVE-2019-6340.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2019/CVE-2019-6340.yaml
Copy

References:

https://nvd.nist.gov/vuln/detail/CVE-2019-6340
https://www.drupal.org/sa-core-2019-003
https://github.com/CVEDB/PoC-List
https://www.synology.com/security/advisory/Synology_SA_19_09
https://www.exploit-db.com/exploits/46452/