VulnCheck KEV: CVE-2014-3704

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys...

PT-2014-5461 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal core versions prior to 7.32 Description: The issue concerns the expandArguments function in the database abstraction API, which does not properly construct prepared statements. This allows remote attackers to conduct SQL injection...