Preliminary research

SELECT-only PostgreSQL exploitation: Drupal case study

N. Maccary · Lexfo / Ambionics

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Develops a SELECT-only Drupal/PostgreSQL injection into large-object file writes, configuration replacement and native module loading in a new backend. The writeup explains database privileges, connection-pool lifecycle and module ABI requirements, showing why configuration reload alone does not immediately execute code in an existing session.

Record

Researcher

N. Maccary

Published by

Lexfo / Ambionics

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Drupal PostgreSQL RCE implementation

Tags

• drupal
• postgres
• sqli
• file-write
• rce
• attack-chain
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of N. Maccary, first published at the original source. Preserved copies are kept so the citation survives its host.