CVE-2017-2641: Moodle SQL Injection via User Preferences
Summary
CVE-2017-2641: Moodle SQL injection via user preferences. Affects moodle/moodle across 4 version ranges.
>= 2.7, < 2.7.19
>= 3.0, < 3.0.9
>= 3.1, < 3.1.5
>= 3.2, < 3.2.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system widely used for online education. It provides a platform for educators to create and deliver courses to students. Moodle is written in PHP and utilizes a database to store user information, course content, and other data. This vulnerability affects Moodle versions 2.x and 3.x.
Vulnerability Detail
The vulnerability in Moodle allows for SQL injection attacks through user preferences. An attacker can exploit this vulnerability by manipulating user preferences to inject malicious SQL code into the database. This can lead to unauthorized access, data leakage, and potential compromise of the entire Moodle system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7, < 2.7.192.7.19composer require moodle/moodle:2.7.19 -
>= 3.0, < 3.0.93.0.9composer require moodle/moodle:3.0.9 -
>= 3.1, < 3.1.53.1.5composer require moodle/moodle:3.1.5 -
>= 3.2, < 3.2.23.2.2composer require moodle/moodle:3.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended patches and upgrade to the fixed versions of Moodle to mitigate the risk.
Conclusion
The SQL injection vulnerability in Moodle via user preferences poses a significant risk to the security and integrity of the system. It is crucial to promptly upgrade to the patched versions of Moodle to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for online education. It provides a platform for educators to create and deliver courses to students.
SQL injection is a type of security vulnerability where an attacker can manipulate SQL queries to execute unauthorized actions or access sensitive data in a database.
This vulnerability can be exploited by an attacker manipulating user preferences in Moodle to inject malicious SQL code into the database, potentially gaining unauthorized access or compromising the system.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8, indicating its high severity and potential impact.
No, there are no known workarounds for this vulnerability. It is essential to apply the recommended patches and upgrade to the fixed versions of Moodle.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
