A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Drupal calls them Drupalgeddon, Drupalgeddon2, and Drupalgeddon3. Three separate critical vulnerabilities across four years. Each one different in mechanism. Each one devastating. If you're running Drupal 7.x or early 8.x without patches, at least one of these owns you.
Vulnerability Profile
Drupalgeddon: Pre-authentication SQL injection in Drupal 7.0 through 7.31. Allows creating admin users or uploading malicious forms without any credentials.
No credentials needed. The SQL injection in the user registration form lets you insert a new admin user directly into the database. From there, enable the PHP Filter module, create a page with a system() call, and you have RCE.
Vulnerability Profile
Drupalgeddon2: Unauthenticated RCE via insufficient input sanitization during user registration. Affects Drupal versions prior to 7.58 and 8.5.1.
The exploit modifies the registration form to inject a command that writes a base64-decoded PHP file to the webroot. No authentication. No admin panel. One HTTP request chain and you own the server.
Vulnerability Profile
Drupalgeddon3: Authenticated RCE via improper validation in the Form API. Requires ability to delete a node. Affects multiple Drupal 7.x and 8.x versions.
Three CVEs. Four years. All still found in the wild because enterprises don't maintain application inventories. Drupal 7.57 from 2018 still shows up on internal assessments. Check CHANGELOG.txt first—if it returns a 404, you're on Drupal 8+ and need droopescan instead.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.