Sploitus

Exploit for Drupal REST module command execution

CVE-2019-6340

saint · 2019-02-27

Exploit Code

MARKDOWN26 lines
## https://sploitus.com/exploit?id=SAINT:4011E98EC245969FF8C7A9BE1894E196
Added: 02/27/2019  
CVE: CVE-2019-6340  
BID: 107106  


### Background

Drupal is an open-source content management system written in PHP. 

### Problem

The Drupal REST module does not properly sanitize input from non-form sources, allowing an attacker to execute arbitrary code. 

### Resolution

Upgrade to Drupal 8.5.11 or 8.6.10 or higher. 

### References

https://www.drupal.org/sa-core-2019-003   


### Platforms

Linux