GitHub Advisoryadvisory · Packagist

GHSA-9xp2-5fr9-7mwm Moodle vulnerable to SQL injection

HIGH Published 2022-05-13 Modified 2025-04-12 Official page ↗
Aliases
CVE-2010-1615
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-89
Reviewed
2025-04-12

Affected packages

• Packagist moodle/moodle: >= 1.8.0, < 1.8.12 → fixed in 1.8.12 • Packagist moodle/moodle: >= 1.9.0, < 1.9.8 → fixed in 1.9.8

Description

Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.

Related

Alias · CVE (1)

  • CVE-2010-1615 Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References