Preliminary research

SELECT-only PostgreSQL exploitation: Drupal case study

Drupal PostgreSQL SQL Injection: From SELECT-Only to RCE

N. Maccary · Lexfo / Ambionics

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Develops a SELECT-only Drupal/PostgreSQL injection into large-object file writes, configuration replacement and native module loading in a new backend. The writeup explains database privileges, connection-pool lifecycle and module ABI requirements, showing why configuration reload alone does not immediately execute code in an existing session.

Record

Document

Drupal PostgreSQL SQL Injection: From SELECT-Only to RCE

Researcher

N. Maccary

Published by

Lexfo / Ambionics

Topic

Other

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Drupal PostgreSQL RCE implementation

Tags

• drupal
• postgres
• sqli
• file-write
• rce
• attack-chain
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of N. Maccary, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.