Vulnerability record · CVE-2014-3704 · published 16 October 2014
CVE-2014-3704: Drupal core database API SQL injection via crafted array keys
DDrupal · Drupal
The expandArguments function in Drupal core's database abstraction API fails to properly construct prepared statements, allowing SQL injection through an array containing crafted keys. This is the pre-authentication flaw known as Drupalgeddon, affecting Drupal 7.x before 7.32. Because it is reachable without credentials and trivially exploitable, it is one of the most consequential Drupal issues on record.
Description
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
critical priorityUnauthenticated remote SQL injection in a widely deployed CMS with public exploit code and an EPSS probability near 1.0 makes this an urgent patch-or-be-compromised issue.
What it is
The expandArguments function in Drupal core's database abstraction API fails to properly construct prepared statements, allowing SQL injection through an array containing crafted keys. This is the pre-authentication flaw known as Drupalgeddon, affecting Drupal 7.x before 7.32. Because it is reachable without credentials and trivially exploitable, it is one of the most consequential Drupal issues on record.
Impact
A remote attacker can inject arbitrary SQL, potentially reading or modifying any data in the Drupal database, including user credentials and session data. In practice this can lead to full site takeover and, depending on database privileges, further compromise of the host.
Attack surface
Reachable over the network through HTTP requests that pass attacker-controlled array keys into the database abstraction layer; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Public exploit code is available from multiple sources (Exploit-DB, Packet Storm, Full Disclosure, and the SektionEins advisory), and EPSS is near 1.0 (0.99974, 99.978th percentile), indicating very high likelihood of exploitation. It is not listed in CISA KEV.
What to do
- Upgrade Drupal core to 7.32 or later immediately; this is the only complete fix.
- If immediate upgrade is impossible, apply the vendor patch from SA-CORE-2014-005 or the documented temporary mitigation (e.g., the Drupal 7.32 hotfix / SQLi protection patch) and treat it as short-term only.
- For Debian-packaged Drupal, apply DSA-3051.
- Restrict database account privileges used by Drupal to the minimum required, limiting the blast radius of any injection.
- After patching, review logs and database contents for signs of prior compromise and rotate credentials and secrets if tampering is suspected.
Detection
- Inspect web and WAF logs for requests with array-style parameter keys (e.g., name[0 ...]) or unusual nested parameter names targeting Drupal endpoints.
- Search for SQL syntax fragments, UNION, or comment sequences in query strings and POST bodies reaching Drupal.
- Monitor database logs for anomalous queries or errors originating from the web application user.
- Check for unexpected administrative users, changed content, or new files in the Drupal installation as post-exploitation indicators.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-3704 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-3704), CISA KEV, FIRST EPSS (scores of 2026-09-16). This page is refreshed as NVD updates the record.
