NVD

Id
31851  
Name
CVE-2014-3704  
Description
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-10-15  
Modified Date
2016-03-31  
Seq
2014-3704  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
167956 31851 CVE-2014-3704 http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html  View
167957 31851 CVE-2014-3704 http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html  View
167958 31851 CVE-2014-3704 http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html  View
167959 31851 CVE-2014-3704 20141016 Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerability  View
167960 31851 CVE-2014-3704 DSA-3051  View
167961 31851 CVE-2014-3704 34984  View
167962 31851 CVE-2014-3704 34992  View
167963 31851 CVE-2014-3704 34993  View
167964 31851 CVE-2014-3704 35150  View
167965 31851 CVE-2014-3704 [oss-security] 20141015 Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerability  View
167966 31851 CVE-2014-3704 20141015 Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerability  View
167967 31851 CVE-2014-3704 70595  View
167968 31851 CVE-2014-3704 https://www.drupal.org/SA-CORE-2014-005  View
167969 31851 CVE-2014-3704 https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html  View
167970 31851 CVE-2014-3704 https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
15987 JVNDB-2014-004862 Drupal core の データベース抽象化 API の expandArguments 関数における SQL インジェクションの脆弱性 Drupal core の データベース抽象化 API の expandArguments 関数は、準備されたステートメントを適切に構築しないため、SQL インジェクション攻撃を実行される脆弱性が存在します。 CVE-2014-3704 70992 CVE-2014-3704 31851 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004862.html 2014-10-15 2014-10-22 View