Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.
Sign up to join this community
Would CiviCRM data have been exposed to a Drupageddon exploit if it happened before I updated the site to Drupal 7.32?
CiviCRM is in a separate MySQL database. However, the site uses Views/CiviCRM integration so all the tables in the CiviCRM database are listed in Drupal’s settings.php file.
I probably would guess, yes to this one especially if you have added the civicrm db to the drupal settings file and/or share the civicrm tables in the same drupal db.
the primary reason for this is, drupal's db access layer (and code) can access the civi db the same way as the drupal db and hence any exploit in that code can be used against the civi db
lobo
Since a potential attacker got access to the database, and through the evil php module, could execute code, everything on the same server must be considered compromised.
To expand on Letharion's answer, any files on the server were vulnerable due to the nature of the exploit. "Arbitrary PHP execution" means server-level access is possible. https://www.drupal.org/SA-CORE-2014-005 With PHP execution you can now have back doors allowing malicious file uploads. Per the Drupal security team PSA https://www.drupal.org/PSA-2014-003, you should consider starting on a clean server entirely.
