Horizon Alert
Summary of the vulnerability and why it matters
A SQL injection vulnerability exists in Drupal core that could allow an attacker to run unauthorized commands and potentially gain full control of the system. This issue is critical because it can be exploited remotely without authentication, impacting data integrity and system availability.
- Attackers can steal sensitive data.
- Full system compromise is possible.
- Affects many websites using Drupal.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this SQL injection flaw in Drupal core by sending specially crafted requests to vulnerable endpoints. This could allow them to manipulate database queries to extract sensitive data, escalate their privileges, or even execute arbitrary code on the server.
- No authentication needed.
- Target vulnerable web endpoints.
- Attacker crafts malicious input.
Live Threat
Current exploitation, exposure, and threat context
This SQL injection vulnerability in Drupal core is highly attractive to attackers due to its critical severity and exploitable nature over the network without authentication. Such vulnerabilities allow attackers to manipulate database queries, potentially leading to unauthorized data access, modification, or even remote code execution, making them a prime target for widespread compromise.
- Listed on CISA KEV.
- Exploited by threat actors.
- Public exploit available.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching all affected Drupal core versions immediately due to the critical SQL injection vulnerability and its inclusion on the CISA Known Exploited Vulnerabilities (KEV) catalog. If immediate patching is not feasible, isolate or take offline any Drupal services that are publicly accessible until mitigations can be applied. This vulnerability is highly exploitable and can lead to complete system compromise.
- Apply Drupal patches 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10.
- Restrict network access to affected servers.
- Monitor logs for SQL injection attempts.
