Critical SQL Injection Vulnerabilities in Drupal Exploited

• •CVE-2014-3704 allows remote code execution in Drupal 7.5.
• •Penetration tests demonstrated successful exploitation via SQL injection.
• •Immediate remediation is necessary to secure affected Drupal installations.

Recent penetration tests revealed multiple critical vulnerabilities in Drupal, specifically CVE-2014-3704, which allows remote code execution. The tests were conducted in a controlled lab environment, demonstrating exploitation methods including SQL injection and privilege escalation. The affected systems include Drupal 7.5, which was found to be vulnerable to 'Drupageddon', leading to a full database dump. Tools such as Metasploit and manual SQL injection techniques were employed during the tests. The exploitation resulted in unauthorized access to sensitive data, including plaintext passwords. Additionally, misconfigured SSH credentials were identified, further increasing the risk. The findings underscore the need for immediate remediation and security hardening for Drupal installations. Current status indicates that these vulnerabilities remain critical and require urgent attention from system administrators.