Drupal Coder Module Deserialization RCE

critical Nessus Plugin ID 92626


A PHP application running on the remote web server is affected by a remote code execution vulnerability.


The version of Drupal running on the remote web server is affected by a remote code execution vulnerability in the Coder module, specifically in file coder_upgrade.run.php, due to improper validation of user-supplied input to the unserialize() function. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary PHP code.


Upgrade the Coder module to version 7.x-1.3 / 7.x-2.6 or later.
Alternatively, remove the entire Coder module directory from any publicly accessible website.

See Also



Plugin Details

Severity: Critical

ID: 92626

File Name: drupal_coder_rce.nasl

Version: 1.4

Type: remote

Family: CGI abuses

Published: 7/29/2016

Updated: 6/13/2018

Dependencies: drupal_detect.nasl

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND

Vulnerability Information

CPE: cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Required KB Items: www/PHP, installed_sw/Drupal

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/13/2016

Vulnerability Publication Date: 7/13/2016

Reference Information

EDB-ID: 40149