Critical SQL Injection Vulnerability in Drupal Core

What changed

A significant SQL injection vulnerability has been discovered in Drupal Core, which allows unauthorized SQL commands to be executed. This vulnerability is due to improper neutralization of special elements used in SQL commands, potentially leading to data breaches or unauthorized access.

Affected versions include Drupal Core from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, and from 11.3.0 before 11.3.10.

Who is affected

This vulnerability impacts a broad range of users and organizations utilizing Drupal for their web applications. The following groups are particularly at risk:

Organizations running outdated versions of Drupal Core may be exposed to SQL injection attacks, which can compromise sensitive data.

• Users of Drupal Core versions from 8.9.0 to 11.3.0.
• Organizations that rely on Drupal for content management and web applications.
• Developers maintaining Drupal sites without timely updates.
• Any entity that processes sensitive information through Drupal.

What to do

It is crucial for organizations using affected versions of Drupal Core to take immediate action to mitigate risks associated with this vulnerability. The recommended steps include:

Updating to the latest version of Drupal Core that addresses this vulnerability is essential to protect against potential SQL injection attacks.

• Upgrade to Drupal Core version 10.4.10 or later, 10.5.10 or later, 10.6.9 or later, 11.1.10 or later, 11.2.12 or later, or 11.3.10 or later.
• Conduct a security audit of existing Drupal installations to identify and remediate any potential vulnerabilities.
• Review and enhance security measures around database access and permissions.
• Stay informed about future updates and vulnerabilities through resources like CISA and NVD.