Exploit for CVE-2019-6340

kitploit · 2026-08-25

Description

Drupal RCE via arbitrary PHP function execution demonstrated in CVE-2019-6340.

Entry point

Parameterlink · request body

Path/node

Drupal RESTful Web Services unserialize() RCE via crafted HAL JSON to /node

Affected Drupal versions

Drupal< 8.5.11, 8.6.10

All known vulnerabilities by product

CVSS 8.1 for CVE-2019-6340

8.1

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:HIGH

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

Exploit Details

Modified:2026-08-25 04:24

Last Seen:2026-08-26 02:59

Reporter:KitPloit

Tags

DrupalRemote Code ExecutionPHP Function ExecutionProof of Concept

Other exploits for CVE-2019-6340

2026-08-27 KitPloitKITPLOIT

Drupal-SA-CORE-2019-003

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass

2026-08-26 KitPloitKITPLOIT

Drupal-cve-2019-6340

2026-08-26 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

drupal8-REST-RCE

2026-08-26 KitPloitKITPLOIT

Exploit Code

MARKDOWN12 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OWAYS-CVE-2019-6340
# CVE-2019-6340

CVE-2019-6340 POC Drupal rce

python poc.py [url] [php func] [command] [node number]

Пример: python poc.py http://192.168.142.148/drupal-8.6.9/ system ipconfig 200

![](https://assets.kitploit.com/production/public/readmes/30368/d9f04a40e6d4c658074d012f95bf291e68166631613e14e9198cfcb9c1635782.png)

Twitter: @0w4ys