Yes, Drupal is vulnerable like any other website. It does not matter what content management system(CMS) you are running. Typically, it can infect index.php in the same as explained in iframe injection article . Sometimes, it can infect various theme folder and tpl files as well.