More than 19 months after it was patched by Drupal developers, a critical SQL injection vulnerability in the popular content management system is still being exploited by malicious actors to hack websites.
The vulnerability in question, tracked as CVE-2014-3704 and dubbed by researchers “Drupalgeddon,” is related to a database abstraction API used in Drupal 7. The flaw allows attackers to execute arbitrary SQL queries, which can lead to privilege escalation or code execution. A patch was released on October 15, 2014.
Just two weeks after the availability of the patch was announced, Drupal warned users that all installations should be assumed compromised unless the fix was applied within 7 hours after its release.
Even today, there still are some organizations that haven’t patched the vulnerability. For instance, a version of Drupal plagued by this flaw had powered a customer portal of Panama-based law firm Mossack Fonseca, from which hackers recently leaked millions of emails, databases, images and documents.
Web security firm Sucuri has been monitoring attacks targeting CVE-2014-3704. According to the company, after the initial attacks in October and November 2014, when thousands of websites were targeted, the number of attacks dropped, but remained consistent throughout 2015 and 2016.
“If someone had not patched, they are surely compromised now. But that doesn’t stop attackers from trying to find new entry points and even compromise already compromised sites,” Sucuri explained in a blog post on Tuesday.
In most cases, malicious actors have leveraged the SQL injection vulnerability to create new admin accounts on Drupal websites, including ones named Derevos, Holako and Mr.R00t2_404. It’s unclear what attackers are doing once they gain access to these sites because Sucuri blocked all the attempts it detected before hackers could cause any damage.
However, the security firm noted that it has observed an increase in SEO spam attacks against Drupal 7 websites.
Related Reading: Critical Drupal Updates Patch Several Vulnerabilities
Related Reading: Drupal Starts Patching Update Process Flaws

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
- Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
- Cisco to Acquire Splunk for $28 Billion
- Car Cybersecurity Study Shows Drop in Critical Vulnerabilities Over Past Decade
- Omron Patches PLC, Engineering Software Flaws Discovered During ICS Malware Analysis
Latest News
- Stealthy APT Gelsemium Seen Targeting Southeast Asian Government
- Nigerian Pleads Guilty in US to Million-Dollar BEC Scheme Role
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
- City of Dallas Details Ransomware Attack Impact, Costs
- In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover
- Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
- Researchers Discover Attempt to Infect Leading Egyptian Opposition Politician With Predator Spyware
- In Other News: New Analysis of Snowden Files, Yubico Goes Public, Election Hacking
