Drupal HTTP Parameter Key/Value SQL Injection Vulnerability

This Metasploit module exploits the Drupal HTTP Parameter Key/Value SQL Injection aka Drupageddon in order to achieve a remote shell on the vulnerable instance. This Metasploit module was tested against Drupal 7.0 and 7.31 was fixed in 7.32. This module requires Metasploit:...

Internet Bug Bounty: Drupal 7 pre auth sql injection and remote code execution

Motivation I found a SQL Injection bug in Drupal $value ... $newkeys$key . '' . $i = $value; The function assumes that it is called with an array which has no keys. Example: dbquery"SELECT FROM users where name IN :name", array':name'=array'user1','user2'; Which results in this SQL Statement SELE...

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2)

array 'method' = 'POST', 'header' = "Content-Type: application/x-www-form-urlencoded\r\n", 'content' = $postdata ; $ctx = streamcontextcreate$params; $data = filegetcontents$url . '?q=node&destination=node', null, $ctx; ifstristr$data, 'mbstrlen expects parameter 1 to be string' && $data echo...

Drupal 7.0 7.31 - Drupalgeddon SQL Injection (PoC) (Reset Password) (2)

Drupal 7.0 7.31 - Drupalgeddon SQL Injection PoC Reset Password 2 array 'method' = 'POST', 'header' = "Content-Type: application/x-www-form-urlencoded\r\n", 'content' = $postdata ; $ctx = streamcontextcreate$params; $data = filegetcontents$url . '?q=node&destination=node', null, $ctx;...

CVE-2014-3704

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys...

CVE-2014-3704

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys...

CVE-2014-3704

creationtimestamp| type| source ---|---|--- 2014-10-16 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/34984 2014-10-17 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/34992 2014-10-17 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/34993 2014-11-03...

CVE-2014-3704

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys...

CVE-2014-3704

CVE-2014-3704 affects Drupal core 7.x; the expandArguments function in the database abstraction API does not properly construct prepared statements, enabling remote SQL injection via an array with crafted keys. Affected are Drupal core 7.x prior to 7.32 (pre-auth vulnerability). Potential impact ...

CVE-2014-3704

Removed by vendor...

Immunity Canvas: DRUPAL_NAME_SQLI

Name| drupalnamesqli ---|--- CVE| CVE-2014-3704 Exploit Pack| CANVAS Description| Drupal injection exploit Notes| CVE Name: CVE-2014-3704 VENDOR: drupal.org Notes: This exploit replaces the password of 'Drupal User' with 'Drupal Password'. If uid is specified, 'Drupal User' is ignored...

SA-CORE-2014-005 - Drupal core - SQL injection

Drupal 7 includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the...

openSUSE Security Update : libzypp (openSUSE-SU-2013:1433-1)

libzypp was adjusted to enhance the RPM GPG key import/handling to avoid a problem with multiple key blobs. Attackers able to supplying a repository could let the packagemanager show another keys fingerprint while a second one was actually used to sign the repository CVE-2013-3704. %NASLMINLEVEL...

openSUSE Security Update : libzypp (openSUSE-SU-2013:1432-1)

libzypp was adjusted to enhance the RPM GPG key import/handling to avoid a problem with multiple key blobs. Attackers able to supplying a repository could let the packagemanager show another keys fingerprint while a second one was actually used to sign the repository CVE-2013-3704. %NASLMINLEVEL...

CVE-2013-3704

CVE-2013-3704 affects the RPM GPG key import/handling in libzypp up to version 12.15.0. When multiple key blobs are used, the signature fingerprint presented to users could differ from the repository’s actual signing key, potentially enabling an attacker to mislead users into trusting a signed re...

Oracle Linux 5 : tetex (ELSA-2012-1201)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1201 advisory. - more robust fix for CVE-2010-3702 773178 - apply patch for CVE-2010-3702,3704 773180 Tenable has extracted the preceding description block directly...

Oracle Linux 5 : poppler (ELSA-2010-0749)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0749 advisory. - Add poppler-0.5.4-CVE-2010-3702.patch Properly initialize parser - Add poppler-0.5.4-CVE-2010-3704.patch Fix crash in broken pdf code 0 Tenable has...

Oracle Linux 4 : kdegraphics (ELSA-2010-0753)

From Red Hat Security Advisory 2010:0753 : Updated kdegraphics packages that fix two security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base...

CVE-2012-3704

CVE-2012-3704 concerns WebKit as used in Apple iTunes prior to 10.7. It enables remote arbitrary-code execution or memory-corruption leading to a possible application crash when visiting a crafted site. Root cause is memory corruption in WebKit’s handling of content. Exploitation details are not ...

CVE-2012-3704

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1...