Back in 2014, a SQLi in Drupal was discovered so serious that in a matter of hours it allowed to automate attacks that compromised hundreds or perhaps thousands of vulnerable servers.