Drupal Coder Module Deserialization RCE

critical Nessus Plugin ID 92626

Language:

Synopsis

A PHP application running on the remote web server is affected by a remote code execution vulnerability.

Description

The version of Drupal running on the remote web server is affected by a remote code execution vulnerability in the Coder module, specifically in file coder_upgrade.run.php, due to improper validation of user-supplied input to the unserialize() function. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary PHP code.

Solution

Upgrade the Coder module to version 7.x-1.3 / 7.x-2.6 or later.
Alternatively, remove the entire Coder module directory from any publicly accessible website.

Plugin Details

Severity: Critical

ID: 92626

File Name: drupal_coder_rce.nasl

Version: 1.5

Type: remote

Family: CGI abuses

Published: 7/29/2016

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:drupal:drupal

Required KB Items: www/PHP, installed_sw/Drupal

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/13/2016

Vulnerability Publication Date: 7/13/2016

Detections

Analytics