Test ID:	1.3.6.1.4.1.25623.1.0.105101
Category:	Web application abuses
Title:	Drupal Core SQLi Vulnerability (SA-CORE-2014-005) - Active Check
Summary:	Drupal is prone to an SQL injection (SQLi) vulnerability.
Description:	Summary: Drupal is prone to an SQL injection (SQLi) vulnerability. Vulnerability Insight: Drupal fails to sufficiently sanitize user-supplied data before using it in an SQL query. Vulnerability Impact: Exploiting this issue could allow an attacker to execute arbitrary code, to gain elevated privileges and to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Affected Software/OS: Drupal 7.x versions prior to 7.32 are vulnerable. Solution: Updates are available. Please see the references for more information. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-3704 BugTraq ID: 70595 http://www.securityfocus.com/bid/70595 Bugtraq: 20141015 Advisory 01/2014: Drupal7 - pre Auth SQL Injection Vulnerability (Google Search) http://www.securityfocus.com/archive/1/533706/100/0/threaded Debian Security Information: DSA-3051 (Google Search) http://www.debian.org/security/2014/dsa-3051 http://www.exploit-db.com/exploits/34984 http://www.exploit-db.com/exploits/34992 http://www.exploit-db.com/exploits/34993 http://www.exploit-db.com/exploits/35150 http://seclists.org/fulldisclosure/2014/Oct/75 http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html http://www.openwall.com/lists/oss-security/2014/10/15/23 http://osvdb.org/show/osvdb/113371 http://secunia.com/advisories/59972
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.