# MA-420.102014: MyCERT Alert - Drupal Core - SQL Injection

**Date:** 17 Oct 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-420.102014  
**Advisory ID:** MA-420.102014

---

**1.0 Introduction**
The Drupal Security Team released updates to address vulnerabilities in Drupal 7 prior to 7.32 to ensure that queries executed against the database are sanitized to prevent from SQL injection attacks. Admins are strongly recommends to updates their sites immediately with the latest version. Drupal is a popular content management system that is free and open source.
**2.0 Impact**
These updates address vulnerabilities in this API that allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the requests this can lead to privilege escalation, arbitrary PHP execution, or other attacks.
**3.0 Affected Products**
Listed below is the affected product:
- Drupal core 7.x versions prior to 7.32.
**4.0 Recommendation**
Drupal users are recommending updating their software by following either of these instructions below:
Install the latest version:
- Users of Drupal 7.x, please upgrade to [Drupal core 7.32](https://www.drupal.org/drupal-7.32-release-notes).
- If you are unable to update to Drupal 7.32 you can apply [this patch](https://www.drupal.org/files/issues/SA-CORE-2014-005-D7.patch) to Drupal's database.inc file to fix the vulnerability until such time as you are able to completely upgrade to Drupal 7.32.
For details, please see the [Drupal core](https://www.drupal.org/project/drupal) project page.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
**5.0    References**
- ALERT [Win][UNIX/Linux] Drupal: Execute arbitrary code/commands - Remote/unauthenticated
<http://www.auscert.org.au/render.html?it=20866>
- SA-CORE-2014-005 - Drupal core - SQL injection
<https://www.drupal.org/SA-CORE-2014-005>
- Drupal Homepage
<https://www.drupal.org/home>
- SQL injection flaw opens Drupal sites to attack
[http://www.zdnet.com/sql-injection-flaw-opens-drupal-sites-to-attack- 7000034719/](http://www.zdnet.com/sql-injection-flaw-opens-drupal-sites-to-attack-7000034719/)