## https://sploitus.com/exploit?id=EF0710BD-5658-5AFA-B761-E8D095262D6E
# SAWPOC — CVE-2018-7600
A Python Proof of Concept for **CVE-2018-7600**, also known as **Drupalgeddon2**.
CVE-2018-7600 is a critical vulnerability affecting certain versions of **Drupal 7**. Under vulnerable configurations, an unauthenticated attacker may be able to inject malicious input and achieve remote code execution.
> ⚠️ **Disclaimer:** This project is intended for educational purposes, CTFs, security research, and authorized penetration testing only. Do not use it against systems without explicit permission.
## Features
* Python-based PoC
* Simple command-line interface
* Colored terminal output using `colorama`
* Designed for security research and authorized testing
## Requirements
* Python 3
* `colorama`
* A legally authorized/test Drupal environment
## Installation
Clone the repository:
```bash
git clone https://github.com/elkhaoudari/sawpoc.git
cd sawpoc
```
Install the required dependency:
```bash
pip3 install colorama
```
Or, if your system uses the Python module form:
```bash
python3 -m pip install colorama
```
## Usage
Make the script executable:
```bash
chmod +x sawpoc.py
```
Run it with Python:
```bash
python3 sawpoc.py
```
Follow the arguments/options displayed by the PoC.
## Vulnerability
**CVE:** CVE-2018-7600
**Name:** Drupalgeddon2
**Affected software:** Drupal 7.x
**Severity:** Critical
**Type:** Remote Code Execution
The vulnerability is related to insufficient sanitization of user-supplied input in Drupal's Form API, allowing specially crafted requests to manipulate server-side processing.
## Lab Testing
For safe testing, use an intentionally vulnerable Drupal 7 instance in an isolated environment such as:
* CTF machines
* Local virtual machines
* Docker labs
* Your own authorized test infrastructure
## Project Structure
```text
sawpoc/
├── sawpoc.py
├── README.md
└── LICENSE
```
## Disclaimer
The author is not responsible for misuse of this tool.
Use SAWPOC only against systems you own or have explicit authorization to test.
## Author
**Abdelilah Elkhaoudari**
GitHub: `@elkhaoudari`