Drupal has patched a critical SQL injection vulnerability in version 7.x of the content management system that can allow arbitrary code execution.