CVE-2014-3704
- State
- Published
- Severity
- Not scored
- Published
- Oct 16, 2014
- Updated
- Aug 6, 2024
- Reserved
- May 14, 2014
Description
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://www.drupal.org/SA-CORE-2014-005
- 20141016 Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerabilitymailing-list
- 20141015 Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerabilitymailing-list
- https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html
- 34984exploit
- 35150exploit
- [oss-security] 20141015 Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerabilitymailing-list
- 59972third-party-advisory
- http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html
- 34992exploit
- DSA-3051vendor-advisory
- 70595vdb-entry
- 34993exploit
- http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html
- 113371vdb-entry
- https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html
- http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.