peter bassill · operator
$ cve CVE-2014-3704 JSON

CVE-2014-3704 EXPLOIT

7.5
HIGH · CVSS 2.0 · EPSS 100% (pctl 100)

Patch early

A public exploit exists.

Description

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.

Scoring

CVSS7.5 (HIGH, v2.0)
VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS99.97% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-89
On CISA KEVno
Public exploityes
Published2014-10-16
Last modified2026-06-17

Affected (2)

VendorProduct
debiandebian linux
drupaldrupal

Public exploits

SourceTitleDate
exploit-dbDrupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Remote Code Execution)2014-11-03
exploit-dbDrupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Admin Session)2014-11-03
exploit-dbDrupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)2014-10-17
exploit-dbDrupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2)2014-10-17
exploit-dbDrupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1)2014-10-16

References

→ the Explorer  ·  watch your stack  ·  NVD