Critical SQL Injection Vulnerability Discovered in Drupal Core

What changed

A serious vulnerability has been found in Drupal Core that allows for SQL injection attacks. This flaw arises from the improper handling of special elements used in SQL commands, which can lead to unauthorized access to the database.

The affected versions span from 8.9.0 to 10.4.10, 10.5.0 to 10.5.10, 10.6.0 to 10.6.9, 11.0.0 to 11.1.10, 11.2.0 to 11.2.12, and 11.3.0 to 11.3.10.

Who is affected

This vulnerability impacts a wide range of users and organizations utilizing Drupal for their web applications. The following groups are particularly at risk:

Organizations that manage websites on Drupal versions listed above are exposed to potential SQL injection attacks.

• Drupal Core users from versions 8.9.0 to 10.4.10
• Users of Drupal 10.5.0 to 10.5.10
• Administrators of Drupal 10.6.0 to 10.6.9
• Webmasters operating on Drupal 11.0.0 to 11.3.10

What to do

It is crucial for affected users to take immediate action to mitigate the risks associated with this vulnerability. Updating to the latest versions of Drupal Core is highly recommended.

Monitoring for any suspicious activity on affected systems should also be prioritized to detect potential breaches.

• Upgrade to the latest patched version of Drupal Core.
• Implement security measures to monitor database access.
• Review and enhance input validation processes within applications.