CVEs / CVE-2014-3704

CVE-2014-3704: n/a n/a vulnerability

• high 7.5 CVSS 2.0 (NVD)
• EPSS 99.9% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
• Last changed at its sources 17 Jun 2026

Description

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.

Affected and fixed versions

Exploitation

Not in the CISA Known Exploited Vulnerabilities catalog as of 30 Oct 2026.

Severity

References

• CVE-2014-3704 on NVD
• http://osvdb.org/show/osvdb/113371 Broken Link
• http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2014/Oct/75 Exploit, Mailing List, Patch, Third Party Advisory
• http://secunia.com/advisories/59972 Third Party Advisory
• http://www.debian.org/security/2014/dsa-3051 Third Party Advisory
• http://www.exploit-db.com/exploits/34984 Exploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/34992 Exploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/34993 Exploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/35150 Exploit, Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2014/10/15/23 Exploit, Mailing List, Patch
• http://www.securityfocus.com/archive/1/533706/100/0/threaded Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/70595 Third Party Advisory, VDB Entry
• https://www.drupal.org/SA-CORE-2014-005 Patch, Vendor Advisory
• https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html Exploit, Patch, Third Party Advisory
• https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html Exploit, Third Party Advisory