In the logs (Drupal 7), I have seen the next entry (I have edited some compromised info). It seems a failed (only I hope it actually failed) attempt to access the login account. I have tried to replicate the error, but cannot have the same error entry with failed login/password, so I am very worried that it originated in some possible breach of Drupal 7 security.

PDOException: SQLSTATE[42000]: Syntax error or access violation: 1064
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' 
'Crap' AND status = 1' at line 1: SELECT * FROM {users} WHERE name = :name_0, :name_1 AND status = 1; Array ( [:name_0] => FcUk
 [:name_1] => Crap )
in user_login_authenticate_validate() (line xxxx of /[HOME_ROOT]/[PUBLIC_HTML_PATH]modules/user/user.module).
  • Appears this is an attempt of no good - drupal.org/node/2403335 – GreenLion Feb 8 '16 at 15:29
  • Yes, thanks for the link. The problem is that it is a PDO database exception, when all attemps of injection should stop at Drupal interface level and send another type of error (failed login). This is extremely serious and embarrasing for Drupal, is it possible that we will live another breach of security as when 7.34, where hundreds of thousends of sites were possibly comprosimed? – Cesar Feb 8 '16 at 16:22
  • 1
    Please see drupal.org/drupalsa05FAQ#comment-9255523 – larowlan Feb 9 '16 at 1:48

I asked a member of the Drupal security team about this and he referred me to https://www.drupal.org/drupalsa05FAQ#comment-9255523.

This points to a user attempting to exploit SA CORE 2014 005, but failing due to the site being patched. Cesar's attempt to reproduce triggers the PDOException, but does not (and cannot) result in actual SQL injection.


There is indeed a very serious vulnerability in 7.35. Strongly recommended to upgrade. The hack attempt can be reproduced by using Chrome navigator, F12 and inspect element on the field name of the Drupal web login page. We copy the line of the input name, we set the name of the HTML elements to name[0] and name[1], respectively, and with any value filled, we submit. Potentially extremely serious and a shame of biblical proportions that this bug survived until 2015.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.