PT-2014-5461 · Drupal · Drupal

Stefan Horst · Publicado 2014-10-16 · Atualizado 2025-09-06 · CVE-2014-3704

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal core versions prior to 7.32

Description The issue concerns the expandArguments function in the database abstraction API, which does not properly construct prepared statements. This allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.

Recommendations For versions prior to 7.32, update to version 7.32 or later to resolve the issue. As a temporary workaround, consider restricting access to the database abstraction API to minimize the risk of exploitation. Avoid using arrays with crafted keys in the affected API until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-3704

DSA-3051-1

MGASA-2014-0423

Produtos afetados

Drupal

Referências · 35

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/drupal_drupageddon.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/34984 · Exploit
• 🔥 http://exploit-db.com/exploits/34984 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2014/10/15/23 · Exploit
• 🔥 http://exploit-db.com/exploits/35150 · Exploit
• 🔥 http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html · Exploit
• 🔥 http://exploit-db.com/exploits/34992 · Exploit
• 🔥 https://sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Oct/75 · Exploit
• 🔥 http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html · Exploit
• 🔥 http://exploit-db.com/exploits/34993 · Exploit
• 🔥 https://exploit-db.com/exploits/34993 · Exploit
• 🔥 https://exploit-db.com/exploits/44355 · Exploit
• 🔥 https://exploit-db.com/exploits/34992 · Exploit