Skip to content
Fencer Intel
high 7.5

CVE-2014-3704 in the critical feed json

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements…

published 12y ago modified 4mo ago also EUVD-2014-3650

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
100.0%
EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
public exploits
6
Metasploit and Exploit-DB, plus a Nuclei check

Summary

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.

Patch / fix

  • drupal drupal 7.32
  • drupal7 Ubuntu 14.04 LTS 7.26-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2014-3704

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2014-3704 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-3704 updated cvss 7.5

drupal7: SQL injection leading to code execution and privilege escalation (SA-CORE-2014-005)

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/multi/http/drupal_drupageddon)
  2. Published

Exploit prediction

99.97% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/multi/http/drupal_drupageddon Drupal HTTP Parameter Key/Value SQL Injection metasploit exploit, excellent rank, 2014-10-15
  • EDB-44355 Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Admin Session) webapps, 2014-11-03
  • EDB-35150 Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Remote Code Execution) webapps, 2014-11-03
  • EDB-34993 Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2) webapps, 2014-10-17
  • EDB-34992 Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User) webapps, 2014-10-17
  • EDB-34984 Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1) webapps, 2014-10-16
  • Nuclei template Drupal SQL Injection nuclei detection template
  • seclists.org http://seclists.org/fulldisclosure/2014/Oct/75 referenced PoC, tagged "exploit" by a source, unverified
  • sektioneins.de https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2014/10/15/23 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html referenced PoC, tagged "exploit" by a source, unverified
  • sektioneins.de https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.