Anatomy of the SQL injection in Drupal’s database comment filtering system SA-CORE-2015-003

Thu, 20 Aug 2015 20:54:03 +0000

In the Drupal security advisory that was released on August 19th, 2015 Drupal’s security team announced that it solved an SQL injection vulnerability in the Drupal database API.

The security advisory contained the following description of the SQL injection vulnerability:

A vulnerability was found in the SQL comment filtering system which could allow a user with elevated permissions to inject malicious code in SQL comments.

The following sections in this article explain where exactly the problem is located in Drupal and what the vulnerability is. Next it will explain when a Drupal site is vulnerable and how the vulnerability has been solved in the Drupal core code.

Drupal: create a view block of all children of a book page

Wed, 15 Apr 2015 18:18:33 +0000

This article explains how you can create a view block that contains all the children of a certain book page.

Drupal on vanstechelman.eu

Anatomy of the SQL injection in Drupal’s database comment filtering system SA-CORE-2015-003

Drupal: create a view block of all children of a book page