The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
http://www.securityfocus.com/bid/70595
http://www.securityfocus.com/archive/1/533706/100/0/threaded
http://www.debian.org/security/2014/dsa-3051
http://secunia.com/advisories/59972
https://www.drupal.org/SA-CORE-2014-005
Source: Mitre, NVD
Published: 2014-10-16
Updated: 2025-04-12
Named Vulnerability: Drupalgeddon
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Severity: High
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: Critical
EPSS: 0.94398