VULNERABILITY INTELLIGENCE

CVE-2014-3704

CVSS score7.5 HIGH
EPSS probability99.97%
CISA KEVNot currently listed
Published2014-10-16
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P

Description

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.

Weakness classification

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Primary references