CVE-2014-3704 The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection atta...
HighCVSS 7.5
EPSS 100.0%
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/drupal | >= 7.0, < 7.32 | 7.32 |
| debian linux | = 7.0 | No fix listed |
References
- 113371 broken-link vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20141016 Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerability exploit mailing-list patch third-party-advisory
- 59972 third-party-advisory
- DSA-3051 third-party-advisory vendor-advisory
- 34984 exploit third-party-advisory vdb-entry
- 34992 exploit third-party-advisory vdb-entry
- 34993 exploit third-party-advisory vdb-entry
- 35150 exploit third-party-advisory vdb-entry
- [oss-security] 20141015 Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerability exploit mailing-list patch
- 20141015 Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerability mailing-list third-party-advisory vdb-entry
- 70595 third-party-advisory vdb-entry
- www.drupal.org patch vendor-advisory
- www.sektioneins.de exploit patch third-party-advisory
- www.sektioneins.de exploit third-party-advisory