CVE-2010-1615: Moodle SQL Injection Vulnerability in Wiki Module
Summary
CVE-2010-1615: Moodle vulnerable to SQL injection. Affects moodle/moodle across 2 version ranges.
>= 1.8.0, < 1.8.12
>= 1.9.0, < 1.9.8
Fixed in 1.8.12 or 1.9.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It is widely used in educational institutions for online learning and course management. However, certain versions of Moodle (1.8.x before 1.8.12 and 1.9.x before 1.9.8) are vulnerable to SQL injection attacks, which can compromise the integrity and confidentiality of the database.
Vulnerability Detail
Multiple SQL injection vulnerabilities exist in Moodle versions 1.8.x before 1.8.12 and 1.9.x before 1.9.8. These vulnerabilities allow remote attackers to execute arbitrary SQL commands through the 'add_to_log' function in the wiki module (mod/wiki/view.php) and through inadequate data validation in some form elements related to lib/form/selectgroups.php. The exploitation of these vulnerabilities can lead to unauthorized access to sensitive data, data manipulation, or even complete database compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.8.0, < 1.8.121.8.12composer require moodle/moodle:1.8.12 -
>= 1.9.0, < 1.9.81.9.8composer require moodle/moodle:1.9.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can restrict access to the affected modules or disable the wiki functionality until the patch is applied. Additionally, implementing web application firewalls (WAF) can help mitigate SQL injection attempts.
Conclusion
The SQL injection vulnerabilities in Moodle versions 1.8.x before 1.8.12 and 1.9.x before 1.9.8 pose significant risks to users and their data. Immediate action is required to update to the latest versions to safeguard against potential exploitation.
See every vulnerability recorded for moodle/moodle →
FAQ
SQL injection is a code injection technique that exploits vulnerabilities in an application's software by inserting or 'injecting' SQL queries via input data from the client to the application.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your composer.lock file.
The risks include unauthorized access to sensitive information, data manipulation, and potential complete control over the database, which can lead to data breaches and loss of integrity.
Yes, it is crucial to update to the latest patched version as soon as possible to protect your system from potential attacks.
Yes, you can prevent SQL injection by implementing prepared statements, using stored procedures, and employing input validation and sanitization techniques.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
