CVE-2014-3704

This exploit leverages a pre-authentication SQL injection vulnerability in Drupal to inject a malicious serialized session payload, leading to remote code execution via session deserialization. The payload is delivered through a crafted cookie, bypassing authentication.

This exploit leverages a SQL injection vulnerability in Drupal 7.x prior to 7.32 by crafting a malicious POST request to modify the admin user's password. The payload updates the admin password to a known hash, allowing authentication bypass.

This exploit targets CVE-2014-3704, a SQL injection vulnerability in Drupal 7.x. It leverages the vulnerability to execute arbitrary SQL queries, potentially leading to authentication bypass or remote code execution.

This exploit leverages a SQL injection vulnerability in Drupal 7.x to reset the admin password by manipulating the 'name' parameter in a POST request. It uses the DrupalHash library to generate a valid password hash for the target user.

This exploit leverages a pre-authentication SQL injection vulnerability in Drupal by crafting a malicious session cookie. It injects a UNION SELECT statement to create a session for a specified user ID, bypassing authentication.

This is a Python3 rewrite of the original Drupalgeddon (CVE-2014-3704) exploit, which targets a pre-authentication SQL injection vulnerability in Drupal 7.x (7.0 to 7.31). The exploit creates a new administrator user by injecting malicious SQL into the 'name' parameter during login.

This is a Python-based exploit for CVE-2014-3704, a SQL injection vulnerability in Drupal 7.x. It automates the exploitation process by crafting malicious requests to extract user credentials and gain unauthorized access.

This repository contains a functional Python exploit for CVE-2014-3704 (Drupalgeddon), which performs SQL injection to create an admin user in Drupal 7.x. It includes a detailed writeup of a black-box audit leading to root access via additional misconfigurations.

This is a Python-based exploit for CVE-2014-3704, a SQL injection vulnerability in Drupal 7.x. It includes functionality to generate random user agents and perform password hashing for Drupal 7, likely to facilitate authentication bypass or privilege escalation.

This PoC exploits CVE-2014-3704 (Drupalgeddon) by injecting malicious cache entries into Drupal's form cache, leading to remote code execution via PHP deserialization and eval. It includes a reverse shell payload targeting a specified IP and port.

This Metasploit module exploits CVE-2014-3704 (Drupageddon), a SQL injection vulnerability in Drupal 7.0-7.31, to achieve remote code execution via two methods: form-cache PHP injection and user-post PHP injection.