Arbitrary PHP Code Execution Vulnerability in Drupal Core by Drupal
CVE-2020-13664
What is CVE-2020-13664?
This vulnerability in Drupal Core allows for arbitrary PHP code execution under specific conditions. An attacker may deceive an administrator into visiting a malicious page, resulting in the creation of a specially named directory on the server's filesystem. This directory could potentially be exploited to brute-force a remote code execution vector, affecting primarily Windows server configurations. Multiple versions of Drupal Core prior to certain updates are susceptible to this security issue, highlighting the importance of timely patches and secure practices.
Affected Version(s)
Drupal Core 8.8.x < 8.8.8
Drupal Core 8.9.x < 8.9.1
Drupal Core 9.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.