CVE-2014-3704
82Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 100%
da publicação à arma0 dias
Publicada no NVD16 de out.
1ª PoC16 de out.
metasploit15 de out.
VulnCheck+2370d
probabilidade de exploração
100%top 1% das CVEs
exploração observada
simVulnCheck
20 exploit(s) público(s)
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
Produtos afetados
n/a · n/aPoCs públicas encontradas — 20✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/35150exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34992exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34984exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34993exploitdbwww.exploit-db.com/exploits/44355não verificadogithubgithub.com/Neldeborg/Drupalgeddon-Python3★ 3githubgithub.com/happynote3966/CVE-2014-3704★ 1githubgithub.com/joaomorenorf/CVE-2014-3704★ 0githubgithub.com/fbm31/Audit-BlackBox-Web-to-Root★ 0githubgithub.com/AleDiBen/Drupalgeddon★ 0vulncheckvulncheck.com/xdb/649e22788447não verificadocve_referencepacketstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.htmlnão verificadocve_referencepacketstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.htmlnão verificadocve_referencewww.exploit-db.com/exploits/34984não verificadocve_referencewww.exploit-db.com/exploits/34992não verificadocve_referencewww.exploit-db.com/exploits/34993não verificadocve_referencewww.exploit-db.com/exploits/35150não verificadovulncheckvulncheck.com/xdb/497be7626f8cnão verificadovulncheckvulncheck.com/xdb/fdd786971c1enão verificadocve_referencepacketstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://osvdb.org/show/osvdb/113371http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.htmlhttp://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.htmlhttp://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2014/Oct/75http://secunia.com/advisories/59972https://www.drupal.org/SA-CORE-2014-005https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.htmlhttps://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.htmlhttp://www.debian.org/security/2014/dsa-3051http://www.exploit-db.com/exploits/34984http://www.exploit-db.com/exploits/34992