Detections
Analytics
CVE-2014-3704
critical
Description
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
References
http://www.securityfocus.com/bid/70595
http://www.securityfocus.com/archive/1/533706/100/0/threaded
https://github.com/sudichai/cve-destroyer
https://github.com/preetideepaksoni/Penetration-Testing-Portfolio
https://github.com/LMunizCiber/pentest-reports
https://github.com/fbm31/Audit-BlackBox-Web-to-Root
https://github.com/SilentProfessor/Web-vulnerability-testing
https://github.com/joaomorenorf/CVE-2014-3704
https://github.com/AleDiBen/Drupalgeddon
https://github.com/shacojx/Drupal-CVE-Exploit-POC
https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html
https://www.drupal.org/SA-CORE-2014-005
https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-3650
http://www.openwall.com/lists/oss-security/2014/10/15/23
http://www.exploit-db.com/exploits/35150
http://www.exploit-db.com/exploits/34993
http://www.exploit-db.com/exploits/34992
http://www.exploit-db.com/exploits/34984
http://seclists.org/fulldisclosure/2014/Oct/75
http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html
http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html
http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html