SA-CORE-2014-005 - Drupal core - SQL injection