Unscored severity · published Oct 16, 2014
CVE-2014-3704
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to…
–
CVSS
100%
EPSS
No
On KEV
Description
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Drupal · Drupal
7.0 before 7.32 · source: NVD
DL
Debian Linux · Debian
7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3704
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3704
Broken Link
http://osvdb.org/show/osvdb/113371
Exploit
http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html
Exploit
http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html
Exploit
http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html
Exploit
http://seclists.org/fulldisclosure/2014/Oct/75
Third Party Advisory
http://secunia.com/advisories/59972
More from Drupal
9.8
CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
9.8
CVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
9.8
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
8.8
CVE-2020-13671
Drupal core Un-restricted Upload of File
8.1
CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution