# MA-626.072016: MyCERT Advisory - Drupal Core - SQL Injection

**Date:** 19 Jul 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-626.072016  
**Advisory ID:** MA-626.072016

---

####
**1.0 Introduction**
Drupal has released an advisory to address a vulnerability in Drupal core 8.x versions prior to 8.1.7. Exploitation of this vulnerability could allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review Drupal's Security Advisory and apply the necessary update.
**2.0 Impact**
The vulnerability could allow a remote attacker to take control of a vulnerable system.
**3.0 Affected Products**
Drupal core 8.x versions prior to 8.1.7.
**4.0 Recommendation**
Drupal users are recommended to update their software by following either of these instructions below:
Install the latest version:
- For Drupal 8.x, need to upgrade to Drupal core 8.1.7.
The update is available at:
<https://www.drupal.org/project/drupal/releases/8.1.7>
- For Drupal 7.x, Drupal core is not affected. However, please refer the mitigation steps that might have modules or other software on the server affected by this issue.
Mitigation steps is available at:
<https://httpoxy.org/>
- For example, sites using Apache can add the following code to .htaccess:
> *<IfModule mod\_headers.c>*
> *RequestHeader unset Proxy*
> *</IfModule>*
- Drupal core 8.0.x is no longer supported. Update to 8.1.7 to get the latest security and bug fixes.
For details, please see the Drupal core project page.
<https://www.drupal.org/project/drupal>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#50332932352269696910332932352223353325223924297e3d29) or [[email protected]](/cdn-cgi/l/email-protection#0b6672686e797f4b6672686e797f2564796c256672)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 -18:00 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
**4.0    References**
- Drupal Releases Security Advisory: <https://www.us-cert.gov/ncas/current-activity/2016/07/18/Drupal-Releases-Security-Advisory>
- Drupal Core - Highly Critical - Injection - SA-CORE-2016-003: <https://www.drupal.org/SA-CORE-2016-003>
- ESB-2016.1770 - [Win][UNIX/Linux] Drupal: Provide misleading information - Remote/unauthenticated: <https://www.auscert.org.au/render.html?it=36913>