{"id":"CVE-2014-3704","url":"https://www.cyber-defence.io/tools/cve/CVE-2014-3704","generatedAt":"2026-11-05T06:44:07.705Z","title":"The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.","description":"The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.","published":"2014-10-16T00:55:07.000Z","lastModified":"2026-06-17T00:08:47.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"2.0","score":7.5,"severity":"HIGH","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},"cwe":["CWE-89"],"affected":["drupal/drupal","debian/debian linux"],"epss":{"score":0.99974,"percentile":0.99978,"date":"2026-11-04","history":[]},"kev":{"listed":false},"exploits":{"count":5,"verified":true,"firstPublished":"2014-10-16","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":44355,"kind":"exploit","title":"Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Admin Session)","url":"https://www.exploit-db.com/exploits/44355","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44355.php","file":"exploits/php/webapps/44355.php","published":"2014-11-03","added":"2018-03-29","updated":"2018-03-29","author":"Stefan Horst","type":"webapps","platform":"php","port":443,"verified":false,"codes":["CVE-2014-3704","OSVDB-113371"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.sektioaneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html"},{"edbId":35150,"kind":"exploit","title":"Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Remote Code Execution)","url":"https://www.exploit-db.com/exploits/35150","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/35150.php","file":"exploits/php/webapps/35150.php","published":"2014-11-03","added":"2014-11-03","updated":"2018-03-29","author":"Stefan Horst","type":"webapps","platform":"php","port":443,"verified":true,"codes":["CVE-2014-3704","OSVDB-113371"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html"},{"edbId":34993,"kind":"exploit","title":"Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2)","url":"https://www.exploit-db.com/exploits/34993","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/34993.php","file":"exploits/php/webapps/34993.php","published":"2014-10-17","added":"2014-10-17","updated":"2018-03-29","author":"Dustin Dörr","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2014-3704","OSVDB-113371"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":34992,"kind":"exploit","title":"Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)","url":"https://www.exploit-db.com/exploits/34992","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/34992.py","file":"exploits/php/webapps/34992.py","published":"2014-10-17","added":"2014-10-17","updated":"2018-03-29","author":"Claudio Viviani","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2014-3704","OSVDB-113371","SA-CORE-2014-005"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":34984,"kind":"exploit","title":"Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1)","url":"https://www.exploit-db.com/exploits/34984","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/34984.py","file":"exploits/php/webapps/34984.py","published":"2014-10-16","added":"2014-10-17","updated":"2018-03-29","author":"stopstene","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2014-3704","SA-CORE-2014-005"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":"http://www.exploit-db.com/screenshots/idlt35000/drupal.png","referenceUrl":"https://pastebin.com/nDwLFV3v"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 100.0%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://osvdb.org/show/osvdb/113371","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://seclists.org/fulldisclosure/2014/Oct/75","tags":["Exploit","Mailing List","Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59972","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.debian.org/security/2014/dsa-3051","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.exploit-db.com/exploits/34984","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://www.exploit-db.com/exploits/34992","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://www.exploit-db.com/exploits/34993","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://www.exploit-db.com/exploits/35150","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2014/10/15/23","tags":["Exploit","Mailing List","Patch"],"source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/archive/1/533706/100/0/threaded","tags":["Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/70595","tags":["Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"https://www.drupal.org/SA-CORE-2014-005","tags":["Patch","Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html","tags":["Exploit","Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html","tags":["Exploit","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://osvdb.org/show/osvdb/113371","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2014/Oct/75","tags":["Exploit","Mailing List","Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/59972","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2014/dsa-3051","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.exploit-db.com/exploits/34984","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.exploit-db.com/exploits/34992","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.exploit-db.com/exploits/34993","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.exploit-db.com/exploits/35150","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2014/10/15/23","tags":["Exploit","Mailing List","Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/533706/100/0/threaded","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/70595","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.drupal.org/SA-CORE-2014-005","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html","tags":["Exploit","Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-3704","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}