SA-CORE-2014-005 Drupal core: SQL injection (15/10/2014)