CVEvulnerability
CVE-2014-3704
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-10-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
Affected configurations
• drupal drupal (>= 7.0 < 7.32)
• debian debian linux 7.0
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://osvdb.org/show/osvdb/113371 Broken Link
- http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2014/Oct/75 Exploit, Mailing List, Patch, Third Party Advisory
- http://secunia.com/advisories/59972 Third Party Advisory
- http://www.debian.org/security/2014/dsa-3051 Third Party Advisory
- http://www.exploit-db.com/exploits/34984 Exploit, Third Party Advisory, VDB Entry
- http://www.exploit-db.com/exploits/34992 Exploit, Third Party Advisory, VDB Entry
- http://www.exploit-db.com/exploits/34993 Exploit, Third Party Advisory, VDB Entry
- http://www.exploit-db.com/exploits/35150 Exploit, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2014/10/15/23 Exploit, Mailing List, Patch
- http://www.securityfocus.com/archive/1/533706/100/0/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/70595 Third Party Advisory, VDB Entry
- https://www.drupal.org/SA-CORE-2014-005 Patch, Vendor Advisory
- https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html Exploit, Patch, Third Party Advisory
- https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html Exploit, Third Party Advisory
- http://osvdb.org/show/osvdb/113371 Broken Link
- http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2014/Oct/75 Exploit, Mailing List, Patch, Third Party Advisory
- http://secunia.com/advisories/59972 Third Party Advisory
- http://www.debian.org/security/2014/dsa-3051 Third Party Advisory
- http://www.exploit-db.com/exploits/34984 Exploit, Third Party Advisory, VDB Entry
- http://www.exploit-db.com/exploits/34992 Exploit, Third Party Advisory, VDB Entry
- http://www.exploit-db.com/exploits/34993 Exploit, Third Party Advisory, VDB Entry
- http://www.exploit-db.com/exploits/35150 Exploit, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2014/10/15/23 Exploit, Mailing List, Patch
- http://www.securityfocus.com/archive/1/533706/100/0/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/70595 Third Party Advisory, VDB Entry
- https://www.drupal.org/SA-CORE-2014-005 Patch, Vendor Advisory
- https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html Exploit, Patch, Third Party Advisory
- https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html Exploit, Third Party Advisory