We have a Production Drupal server serving content but some pages are broken when a pager link is clicked upon. It was found that the URL's are being changed with unrecognizable keywords. For example,
For the URL
the URL is changed to
Similarly, cmd.php is sometimes replaced by /contact and /www.googletagmanager.com/ns.html in the last few days.
The Drupal log has a successful GET when the link is clicked as shown below. By the looks of it, we suspect a SQL injection. What do you think?
www.foo.com/poem/case/index.html/contact?search_api_views_fulltext=&page=21&%3Bamp%2525252525253bamp%2525252525253b%2525252525253bamp%2525252525253bpage=1&%3Bamp%2525252525253bamp%2525252525253b%2525252525253bpage=1&%3Bamp%2525252525253bamp%2525252525253bpage=3&%3Bamp%2525252525253bpage=2&%3Bpage=3 HTTP/1.1" 200 19997