Russian Vulnerability Scanner Database

Back to List

CVE-2014-3704

Scores

EPSS

0.944High94.4%
0%20%40%60%80%100%

Percentile: 94.4%

CVSS

7.5High2.0
0246810

CVSS Score: 7.5/10

All CVSS Scores

CVSS 2.0
7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdubuntu

CWEs

CWE-89

Exploits

Exploit ID: 34984

Source: exploitdb

URL: https://www.exploit-db.com/exploits/34984

Exploit ID: 34992

Source: exploitdb

URL: https://www.exploit-db.com/exploits/34992

Exploit ID: 34993

Source: exploitdb

URL: https://www.exploit-db.com/exploits/34993

Exploit ID: 35150

Source: exploitdb

URL: https://www.exploit-db.com/exploits/35150

Exploit ID: 44355

Source: exploitdb

URL: https://www.exploit-db.com/exploits/44355

Exploit ID: CVE-2014-3704

Source: github-poc

URL: https://github.com/joaomorenorf/CVE-2014-3704

Vulnerable Software (5)

Type: Configuration

Product: drupal6

Operating System: debian

Trait: 
{
  "unaffected": true
}

Source: debian

Type: Configuration

Product: drupal7

Operating System: ubuntu trusty 14.04

Trait: 
{
  "fixed": "7.26-1ubuntu0.1"
}

Source: ubuntu

Type: Configuration

Product: drupal7

Operating System: debian

Trait: 
{
  "fixed": "7.32-1"
}

Source: debian

Type: Configuration

Vendor: debian

Product: debian_linux

Operating System: * * *

Trait: 
{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd

Type: Configuration

Vendor: drupal

Product: drupal

Operating System: * * *

Trait: 
{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.32",
      "versionStartIncluding": "7.0",
      "vulnerable": true
    }
  ],
  "...

Source: nvd