## https://sploitus.com/exploit?id=CEF9AA6D-D7C9-51EF-8058-B1E4BEDD3F5F
# CVE-2018-7600 (Drupalgeddon2) — Red Team Project
### ITSOLERA Cybersecurity Department | Offensive Security Internship 2026
---
## Overview
This project researches, replicates, and documents **CVE-2018-7600 (Drupalgeddon2)** —
a Critical (CVSS 9.8) unauthenticated Remote Code Execution vulnerability in Drupal CMS,
affecting versions prior to 7.58 and 8.5.1 (released March 2018).
The vulnerability exists in Drupal's Form API, which failed to sanitize user-supplied
input before merging it into form element render properties — allowing attackers to
inject PHP callables that the Render API would then execute.
> ⚠️ **For educational use only. All testing must be performed exclusively against
> the isolated Docker lab environment. Never test on live or production systems.**
---
## Team Structure
| Member | Role | Deliverables |
|---|---|---|
| Member 1 | Lab Environment & CVE Verification | Dockerfile, docker-compose, SETUP.md |
| Member 2 | Exploit Development | exploit.py framework, payloads.txt |
| Member 3 | Root Cause Analysis & Research | root_cause_analysis.md, references.md, mitigation.md |
| Member 4 | Proof Collection & Final Report | terminal_logs.txt, screenshots, final report |
---
## Project Structure
```
CVE-2018-7600-Project/
│
├── README.md ← you are here
│
├── lab/ ← Member 1
│ ├── Dockerfile ← builds Drupal 7.57 image
│ ├── docker-compose.yml ← orchestrates all services
│ ├── entrypoint.sh ← DB wait + auto-config script
│ ├── SETUP.md ← step-by-step setup guide
│ └── config_notes.md ← vulnerability verification
│
├── exploit/ ← Member 2
│ ├── exploit.py ← PoC Python framework
│ └── payloads.txt ← payload research notes
│
├── docs/ ← Member 3
│ ├── root_cause_analysis.md ← technical deep-dive
│ ├── references.md ← all sources & links
│ └── mitigation.md ← patch & hardening guide
│
├── proof/ ← Member 4
│ ├── screenshots/ ← exploitation screenshots
│ └── terminal_logs.txt ← command output logs
│
└── report/
└── CVE-2018-7600_Report.docx ← Member 4: final report
```
---
## Quick Start
### 1. Start the Lab
```bash
cd lab/
docker compose up -d --build
```
### 2. Install Drupal
Open http://localhost:8080/install.php and follow SETUP.md Step 3.
### 3. Verify the Target
```bash
curl -s http://localhost:8080/CHANGELOG.txt | head -3
# Expected: Drupal 7.57, 2018-02-21
```
### 4. Run the Exploit
```bash
cd .. # project root
python exploit/exploit.py --target http://localhost:8080 --safe-mode
python exploit/exploit.py --target http://localhost:8080 --cmd "id"
```
### 5. Capture Proof
```bash
python exploit/exploit.py --target http://localhost:8080 --cmd "id" \
--output proof/terminal_logs.txt
```
### 6. Reset Lab
```bash
cd lab/
docker compose down -v && docker compose up -d --build
```
---
## CVE Summary
| Property | Value |
|---|---|
| CVE ID | **CVE-2018-7600** |
| Nickname | Drupalgeddon2 |
| Vendor Advisory | SA-CORE-2018-002 |
| CVSS v3 | **9.8 Critical** |
| Affected | Drupal < 7.58, < 8.3.9, < 8.4.6, < 8.5.1 |
| Fixed in | 7.58, 8.3.9, 8.4.6, 8.5.1 |
| Auth Required | **No** |
| Type | Remote Code Execution |
---
## References
- MITRE: https://vulners.com/cve/CVE-2018-7600
- Drupal Advisory: https://www.drupal.org/sa-core-2018-002
- ExploitDB #44449: https://www.exploit-db.com/exploits/44449
- Rapid7: https://www.rapid7.com/db/vulnerabilities/drupal-cve-2018-7600/
---
*ITSOLERA Red Team Internship — Summer 2026*