Would CiviCRM data have been exposed to a Drupageddon exploit if it happened before I updated the site to Drupal 7.32?

CiviCRM is in a separate MySQL database. However, the site uses Views/CiviCRM integration so all the tables in the CiviCRM database are listed in Drupal’s settings.php file.

3 Answers 3


I probably would guess, yes to this one especially if you have added the civicrm db to the drupal settings file and/or share the civicrm tables in the same drupal db.

the primary reason for this is, drupal's db access layer (and code) can access the civi db the same way as the drupal db and hence any exploit in that code can be used against the civi db



Since a potential attacker got access to the database, and through the evil php module, could execute code, everything on the same server must be considered compromised.

  • Does it make a difference if the PHP module is turned off?
    – Shai
    Nov 6, 2014 at 21:26
  • 2
    @Shai No, as database access means the attackers are able to turn it on.
    – ceejayoz
    Nov 6, 2014 at 22:15

To expand on Letharion's answer, any files on the server were vulnerable due to the nature of the exploit. "Arbitrary PHP execution" means server-level access is possible. https://www.drupal.org/SA-CORE-2014-005 With PHP execution you can now have back doors allowing malicious file uploads. Per the Drupal security team PSA https://www.drupal.org/PSA-2014-003, you should consider starting on a clean server entirely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.