{"id":"CVE-2014-3704","aliases":["DEBIAN-CVE-2014-3704","DSA-3051-1","EUVD-2014-3650","GHSA-f9cm-c972-9975","MGASA-2014-0423","UBUNTU-CVE-2014-3704"],"status":"published","title":"The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does...","description":"The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.99974,"percentile":0.99978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-89"],"published":"2014-10-15T00:00:00Z","modified":"2026-06-17T00:08:47Z","exploits":[{"source":"exploitdb","id":"EDB-34984","title":"Drupal 7.0 \u003c 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1)","type":"webapps","platform":"php","date":"2014-10-16","verified":true,"url":"https://www.exploit-db.com/exploits/34984"},{"source":"exploitdb","id":"EDB-34992","title":"Drupal 7.0 \u003c 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)","type":"webapps","platform":"php","date":"2014-10-17","verified":true,"url":"https://www.exploit-db.com/exploits/34992"},{"source":"exploitdb","id":"EDB-34993","title":"Drupal 7.0 \u003c 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2)","type":"webapps","platform":"php","date":"2014-10-17","verified":true,"url":"https://www.exploit-db.com/exploits/34993"},{"source":"exploitdb","id":"EDB-35150","title":"Drupal 7.0 \u003c 7.31 - 'Drupalgeddon' SQL Injection (Remote Code Execution)","type":"webapps","platform":"php","date":"2014-11-03","verified":true,"url":"https://www.exploit-db.com/exploits/35150"},{"source":"exploitdb","id":"EDB-44355","title":"Drupal 7.0 \u003c 7.31 - 'Drupalgeddon' SQL Injection (Admin Session)","type":"webapps","platform":"php","date":"2014-11-03","url":"https://www.exploit-db.com/exploits/44355"},{"source":"metasploit","id":"exploit/multi/http/drupal_drupageddon","title":"Drupal HTTP Parameter Key/Value SQL Injection","type":"exploit","platform":"PHP","date":"2014-10-15","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/drupal_drupageddon"},{"source":"nuclei","id":"CVE-2014-3704","title":"Drupal SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-3704.yaml"},{"source":"pocgithub","id":"AleDiBen/Drupalgeddon","title":"AleDiBen/Drupalgeddon","date":"2022-10-18","url":"https://github.com/AleDiBen/Drupalgeddon"},{"source":"pocgithub","id":"CyberCTF/vulhub-drupal-cve-2014-3704","title":"CyberCTF/vulhub-drupal-cve-2014-3704","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-drupal-cve-2014-3704"},{"source":"pocgithub","id":"Neldeborg/Drupalgeddon-Python3","title":"Neldeborg/Drupalgeddon-Python3","date":"2025-01-06","url":"https://github.com/Neldeborg/Drupalgeddon-Python3"},{"source":"pocgithub","id":"adfortunato/metasploitable3-pentest-writeup","title":"adfortunato/metasploitable3-pentest-writeup","date":"2026-09-13","url":"https://github.com/adfortunato/metasploitable3-pentest-writeup"},{"source":"pocgithub","id":"fbm31/Audit-BlackBox-Web-to-Root","title":"fbm31/Audit-BlackBox-Web-to-Root","date":"2025-12-31","url":"https://github.com/fbm31/Audit-BlackBox-Web-to-Root"},{"source":"pocgithub","id":"happynote3966/CVE-2014-3704","title":"happynote3966/CVE-2014-3704","date":"2018-07-11","url":"https://github.com/happynote3966/CVE-2014-3704"},{"source":"pocgithub","id":"joaomorenorf/CVE-2014-3704","title":"joaomorenorf/CVE-2014-3704","date":"2025-02-02","url":"https://github.com/joaomorenorf/CVE-2014-3704"}],"fixes":[{"ecosystem":"Debian:7","package":"drupal7","fixed_in":["7.14-2+deb7u7"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"drupal","fixed_in":["7.32-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"drupal","fixed_in":["7.32-1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"drupal7","fixed_in":["7.26-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u7"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2","7.14-2+deb7u2~bpo60+1","7.14-2+deb7u3","7.14-2+deb7u4","7.14-2+deb7u4~bpo60+1","7.14-2+deb7u5","7.14-2+deb7u6","7.14-2+deb7u6~bpo60+1","7.14-2+deb7u7~bpo60+1"]},{"source":"osv","ecosystem":"Mageia:3","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.32-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.32-1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.26-1ubuntu0.1"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"drupal","product":"drupal"}],"references":[{"url":"https://www.drupal.org/SA-CORE-2014-005","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"http://seclists.org/fulldisclosure/2014/Oct/75","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/archive/1/533706/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","report"]},{"url":"http://www.exploit-db.com/exploits/34984","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.exploit-db.com/exploits/35150","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2014/10/15/23","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Patch","report"]},{"url":"http://secunia.com/advisories/59972","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.exploit-db.com/exploits/34992","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.debian.org/security/2014/dsa-3051","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","web"]},{"url":"http://www.securityfocus.com/bid/70595","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.exploit-db.com/exploits/34993","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://osvdb.org/show/osvdb/113371","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link"]},{"url":"https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3704"},{"url":"https://github.com/advisories/GHSA-f9cm-c972-9975"},{"url":"https://advisories.mageia.org/MGASA-2014-0423.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14298","tags":["report"]},{"url":"https://www.drupal.org/drupal-7.32","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.32-release-notes","tags":["web"]},{"url":"http://www.sektioneins.com/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3704","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3704","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-3704","description":"The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.","status":"published","published":"2014-10-16T00:00:00Z","modified":"2024-08-06T10:50:17.99Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-3650","description":"The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.","status":"published","published":"2014-10-16T00:00:00Z","modified":"2024-08-06T10:50:17Z","updated_at":"2026-11-03T01:57:09.905604Z"}],"ghsa":[{"id":"GHSA-f9cm-c972-9975","title":"The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does...","description":"The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.","status":"published","published":"2022-05-13T01:05:42Z","modified":"2023-02-01T05:02:50Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:49:58.981291Z"}],"nvd":[{"id":"CVE-2014-3704","description":"The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.","status":"published","published":"2014-10-16T00:55:06.653Z","modified":"2026-06-17T00:08:47.197Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:02:56.601372Z"}],"osv":[{"id":"DSA-3051-1","title":"drupal7 - security update","status":"published","published":"2014-10-15T00:00:00Z","modified":"2026-03-09T01:17:47.553711Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0423","title":"Updated drupal packages fix security vulnerability","description":"An SQL Injection issue exists in Drupal before 7.32 due to the way the Drupal\ncore handles prepared statements. A malicious user can inject arbitrary SQL\nqueries, and thereby completely control the Drupal site. This vulnerability\ncan be exploited by remote attackers without any kind of authentication\nrequired (CVE-2014-3704).\n","status":"published","published":"2014-10-25T20:23:09Z","modified":"2026-04-16T06:23:18.875518598Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-3704","description":"The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.","status":"published","published":"2014-10-16T00:55:00Z","modified":"2025-07-16T07:32:00.452692Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}