Add Drupal PostgreSQL EntityQuery SQLi scanner

[JohannesLks]

Thank you for contributing to Metasploit Framework! Your time and effort help make this project better for the entire security community. If you have questions at any point, reach out on GitHub Discussions or the Metasploit Slack.

Description

Adds auxiliary/scanner/http/drupal_pgsql_entityquery_sqli for CVE-2026-9082, an unauthenticated SQL injection in Drupal core's PostgreSQL EntityQuery condition handler. The module confirms the injection using the framework's PostgreSQL time-based blind SQLi implementation.

This adds remote detection for vulnerable Drupal installations without modifying the target. MySQL, MariaDB, and SQLite are not affected.

Related Issue: Closes #21509

Breaking Changes

None

Verification Steps

1. • Follow the Podman setup in documentation/modules/auxiliary/scanner/http/drupal_pgsql_entityquery_sqli.md.
2. • Start Metasploit on the target network and use auxiliary/scanner/http/drupal_pgsql_entityquery_sqli.
3. • Set RHOSTS to drupal-web-pg, set RPORT to 80, and run check. Confirm Drupal 11.2.0 is reported vulnerable.
4. • Set RHOSTS to drupal-web-patched and run check. Confirm Drupal 11.2.12 is reported safe.

Test Evidence

msf auxiliary(scanner/http/drupal_pgsql_entityquery_sqli) > set RHOSTS drupal-web-pg
RHOSTS => drupal-web-pg
msf auxiliary(scanner/http/drupal_pgsql_entityquery_sqli) > check
[+] 10.89.8.7:80 - The target is vulnerable. Time-based blind SQL injection via JSON:API filter array key
msf auxiliary(scanner/http/drupal_pgsql_entityquery_sqli) > run
[+] 10.89.8.7:80 - The target is vulnerable. Time-based blind SQL injection via JSON:API filter array key
[*] Auxiliary module execution completed
msf auxiliary(scanner/http/drupal_pgsql_entityquery_sqli) > set RHOSTS drupal-web-patched
RHOSTS => drupal-web-patched
msf auxiliary(scanner/http/drupal_pgsql_entityquery_sqli) > check
[*] 10.89.8.8:80 - The target is not exploitable. No time-based SQL injection response detected

Environment

Field	Details
Operating System	Ubuntu 24.04 host, targets running as Podman containers
Target Software/Hardware	Drupal 11.2.0 and 11.2.12 with PostgreSQL 16.3
Docker Image / Vagrant Setup	Official drupal:{11.2.0,11.2.12}-apache, postgres:16.3-alpine, and metasploitframework/metasploit-framework:latest; setup is documented in the module documentation

AI Usage Disclosure

Claude and GPT were used as support in writing the code for this module.

Pre-Submission Checklist

• Included a corresponding documentation markdown file in documentation/modules (new modules only)
• No sensitive information (IP addresses, credentials, API keys, hashes) in code or documentation
• Tested on the target environment specified in the Environment section above
• Included RSpec tests for library changes (encouraged for lib/ changes; not applicable)
• Read the CONTRIBUTING.md and module acceptance guidelines

Hardware and Complex Software Module Guidance

If your module targets specialized hardware (routers, IoT, PLCs, etc.) or complex software (licensed, multi-service, or multi-version), provide a pcap, screen recording, or video showing successful execution.

Email sanitized pcaps/recordings to msfdev@metasploit.com — remove real IPs, credentials, and hostnames before sending. If hardware/software is unavailable, explain in the PR description.

Responsiveness and PR Takeover Policy

We want every contribution to make it into the project. If approximately 2 weeks pass after a review request without a comment or code update from you, the team may take over the PR and complete the work on your behalf.

If this happens, you will remain credited as a co-author on the final commit — your contribution is always recognized.

This policy exists to keep the project moving forward. It is not a reflection on the quality of your work or your involvement. Life happens, and we would rather finish the work together than let a good contribution go stale.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.