Description
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Moodle Project moodle
Default version status: unaffected
5.3.0affected5.2.0 to ≤ 5.2.4affected5.1.0 to ≤ 5.1.8affected5.0.0 to ≤ 5.0.11affected0 to ≤ 4.5.15affected
pkg:github/moodle/moodleReferences
- https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L918-L926 ↗
- https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L971-L979 ↗
- https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L527-L528 ↗
- https://abraxaslabs.tech/research/moodle-enrol-database-sqli ↗
- https://github.com/moodle/moodle ↗
- https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and-4.5.15-sql-injection-via-enrol-database-course-idnumber ↗