SQL Injection in Drupal - CVE-2014-3704
Published: September 14, 2016 / Updated: September 14, 2018
Vulnerability identifier: #VU445
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-3704
CWE-ID: CWE-564
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows an anonymous user to conduct a SQL injection attack.
The weakness exists in database abstraction API preventing the system from SQL injections. Sending of specially crafted request to API may lead to privilege escalation, arbitrary PHP execution, or other attacks such as SQL injection.
Successful exploitation of this vulnerability may allow an anonymous attacker to perorm SQL injection attack.
The weakness exists in database abstraction API preventing the system from SQL injections. Sending of specially crafted request to API may lead to privilege escalation, arbitrary PHP execution, or other attacks such as SQL injection.
Successful exploitation of this vulnerability may allow an anonymous attacker to perorm SQL injection attack.
Affected software
Drupal
Debian Linux
Fedora
drupal7
Debian Linux
Fedora
drupal7
How to mitigate CVE-2014-3704
drupal7 - addressed in versions 7.32-1.el6, 7.32-1.fc21
Links to Public Exploits and PoC-codes
- Exploit #399 - Drupal < 7.32 - Unauthenticated SQL Injection (March 18, 2020)
- Exploit #400 - Drupal 7.32 - SQL Injection (PHP) (March 18, 2020)
- Exploit #401 - Drupal 7.0 < 7.31 - SQL Injection (2) (March 18, 2020)
- Exploit #402 - Drupal 7.0 < 7.31 - SQL Injection (1) (March 18, 2020)
- Exploit #1775 - Drupal HTTP Parameter Key/Value SQL Injection (March 18, 2020)