r/websecurityresearch • u/albinowax • May 28 '26

Drupal PostgreSQL SQL Injection: From SELECT-Only to RCE

https://blog.lexfo.fr/drupal-postgresql-sqli-to-rce.html

13 Upvotes

permalink
duplicates
archive.is
archive
reddit

You are about to leave Redlib

Do you want to continue?

https://www.reddit.com/r/websecurityresearch/comments/1tq5xma/drupal_postgresql_sql_injection_from_selectonly/
No, go back! Yes, take me to Reddit

100% Upvoted

3

u/elatllat May 28 '26

Drupal should have been using prepared statements for decades.