Home > Vulnerability Database > CVE-2014-3704

Mend.io Vulnerability Database

CVE-2014-3704

Date: October 15, 2014

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.

Language: PHP

Severity Score

7.3

Related Resources (20)

Url: http://secunia.com/advisories/59972

Url: http://www.securityfocus.com/bid/70595

Url: http://www.exploit-db.com/exploits/35150

Url: https://www.drupal.org/SA-CORE-2014-005

Url: http://www.debian.org/security/2014/dsa-3051

Url: http://www.exploit-db.com/exploits/34992

Url: http://www.openwall.com/lists/oss-security/2014/10/15/23

Url: http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html

Url: http://osvdb.org/show/osvdb/113371

Url: http://www.exploit-db.com/exploits/34993

Url: http://seclists.org/fulldisclosure/2014/Oct/75

Url: http://www.exploit-db.com/exploits/34984

Url: https://nvd.nist.gov/vuln/detail/CVE-2014-3704

Url: http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html

Url: https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html

Url: http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html

Url: http://www.securityfocus.com/archive/1/533706/100/0/threaded

Url: https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2014-3704

Url: https://www.mend.io/vulnerability-database/CVE-2014-3704

Severity Score

7.3

Weakness Type (CWE)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-89

CVSS v3.1

Base Score:	7.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2014-3704

Date: October 15, 2014

Language: PHP

Severity Score

Related Resources (20)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?