False negative: "Not exploitable"

[Cybso]

This PoC assumes that the document root is writable by www-data, which is hopefully not the case for most installations. A more reliable test would be to write the file to sites/default/files/.

[quinncomendant]

I wonder if using sleep 5 would be possible to exec. Benefits: 1) no change to website, and 2) immediate confirmation (if script takes < 5 seconds to return, is not vulnerable) without need to check server for file creation. Is it good?

Edit: unless echo 1 is possible, but I got the impression there is no way to view output from the exploit.

[RicterZ]

The best way I think is using payload print(md5("drupalexploited")), then checking if c5859e34009636536a1409c4b2e11431 in the result.

[paddibr]

it is possible to use chmod to make the document root writable?

@Cybso Is the path sites/default/files/ working for you?