CVE-2014-3704 | BDVDB-2026-65055 Detail
Description#
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- https://www.drupal.org/SA-CORE-2014-005
- http://seclists.org/fulldisclosure/2014/Oct/75
- http://www.securityfocus.com/archive/1/533706/100/0/threaded
- https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html
- http://www.exploit-db.com/exploits/34984
- http://www.exploit-db.com/exploits/35150
- http://www.openwall.com/lists/oss-security/2014/10/15/23
- http://secunia.com/advisories/59972
- http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html
- http://www.exploit-db.com/exploits/34992
- http://www.debian.org/security/2014/dsa-3051
- http://www.securityfocus.com/bid/70595
- http://www.exploit-db.com/exploits/34993
- http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html
- http://osvdb.org/show/osvdb/113371
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.