Drupal Vulnerability: Mass Scans & Targeted Exploitation

A critical SQL injection vulnerability (Drupal SA-CORE-2014-005) affecting Drupal 7 was disclosed and patched, but public proof-of-concept code appeared hours later and was leveraged by attackers to mass-scan and target sites in the wild. Volexity observed exploit attempts—including payloads that set the admin account to a known username/password—and confirmed multiple breaches; the report includes example exploit requests, observed User-Agents, CHANGELOG.txt reconnaissance behavior, detection signatures (Suricata/Snort) and immediate mitigation guidance (patching, log/database review, restricting admin access, 2FA).