CVE-2014-3704
HIGH 7.5EPSS 100.0%
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
- CVSS v2.0
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 99.97% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- high · CWE-89
- Published
- 2014-10-16
- Updated
- 2024-08-06
Proof-of-concept exploits (14)
- http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html
- http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html
- http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection…
- http://seclists.org/fulldisclosure/2014/Oct/75
- http://www.exploit-db.com/exploits/34984
- http://www.exploit-db.com/exploits/34993
- http://www.exploit-db.com/exploits/35150
- http://www.openwall.com/lists/oss-security/2014/10/15/23
- https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vu…
- https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html
- http://www.exploit-db.com/exploits/34992
- Neldeborg/Drupalgeddon-Python33★ · 2025-01-06
- happynote3966/CVE-2014-37041★ · 2018-07-17
- joaomorenorf/CVE-2014-37041★ · 2025-02-02
Nuclei templates (1)
Metasploit modules (1)
ExploitDB entries (5)
- https://www.exploit-db.com/exploits/35150
- https://www.exploit-db.com/exploits/34993
- https://www.exploit-db.com/exploits/34992
- https://www.exploit-db.com/exploits/34984
- https://www.exploit-db.com/exploits/44355
Vulhub environments (1)
Exploit collections (2)
- chaitin/xray/blob/master/pocs/drupal-cve-2014-3704-sqli.yml
- zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2014/CVE-2014-3704.yaml