drupal: pre-auth sql injection

Drupal 7 includes a database abstraction API to ensure that queries
executed against the database are sanitized to prevent SQL injection
attacks.
A vulnerability in this API allows an attacker to send specially crafted
requests resulting in arbitrary SQL execution. Depending on the content
of the requests this can lead to privilege escalation, arbitrary PHP
execution, or other attacks.
This vulnerability can be exploited by anonymous users.

This vulnerability has been marketed as drupageddon by the discoverer,
Sektion Eins.