Description
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
moodle
Default version status: unaffected
5.2.0 to < 5.2.2affected5.1.0 to < 5.1.6affected5.0.0 to < 5.0.9affected0 to < 4.5.13affected