CVE-2014-3704

CVE-2014-3704, known as "Drupalgeddon," is a critical SQL injection vulnerability affecting Drupal core 7.x before version 7.32. This flaw in the expandArguments function allows remote unauthenticated attackers to execute arbitrary SQL queries by crafting malicious array keys in HTTP parameters. With a CVSS score of 7.5, it carries a high risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. The vulnerability has extensive public exploit code available, including Metasploit modules and numerous ExploitDB entries demonstrating administrative access and remote code execution, and has garnered significant community discussion and media coverage, indicating its widespread impact and active exploitation.