Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 442
Alerts This Week
Warning Icon 1 442

Drupal Critical Advisory: Assume Compromise for SQL Injection Threat

Calendar Oct 30, 2014 • User Avatar Anthony Pell
1 min read
General Esm H446
Topics%20covered

Topics Covered

security advisory SQL Injection critical web application threat security patch Drupal
If your organization uses Drupal, you might have a serious problem on your hands. On October 15, Drupal urged users to apply an update that fixed a SQL Injection flaw. However, unless that patch was installed within seven hours, Drupal now says it's best to assume the website was completely compromised.

The SQL Injection vulnerability exists in an API used by Drupal, which is supposed to prevent SQL Injection. It was re-discovered by German security firm SektionEins in September, after a Drupal user hired them to check for vulnerabilities.

The link for this article located at CSO Online is no longer available.