CVE-2024-43436: Moodle SQL Injection Vulnerability in XMLDB Editor
Summary
CVE-2024-43436: Moodle vulnerable to site administration SQL injection via XMLDB editor. Affects moodle/moodle across 4 version ranges.
< 4.1.12
>= 4.2.0-beta, < 4.2.9
>= 4.3.0-beta, < 4.3.6
>= 4.4.0-beta, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43436 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. The platform is widely used in educational institutions for course management and delivery. However, it has been identified that the XMLDB editor tool, which is accessible to site administrators, contains a SQL injection vulnerability that could potentially compromise the integrity of the database.
Vulnerability Detail
A SQL injection risk flaw was discovered in the XMLDB editor tool available to site administrators in Moodle. This vulnerability arises from improper handling of user input, allowing an attacker to manipulate SQL queries executed by the database. If exploited, this could lead to unauthorized access to sensitive data, data corruption, or even complete control over the database. The vulnerability is classified under CWE-89, indicating its nature as a SQL injection issue, and has a CVSS score of 7.2, reflecting its moderate severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12composer require moodle/moodle:4.1.12 -
>= 4.2.0-beta, < 4.2.94.2.9composer require moodle/moodle:4.2.9 -
>= 4.3.0-beta, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0-beta, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, site administrators can restrict access to the XMLDB editor tool to trusted users only, minimizing the risk of exploitation until the package is updated.
Conclusion
The SQL injection vulnerability identified in Moodle's XMLDB editor poses a significant risk to database integrity and security. It is crucial for site administrators to update their installations to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for moodle/moodle →
FAQ
The vulnerability is a SQL injection flaw in the XMLDB editor tool of Moodle, allowing attackers to manipulate SQL queries.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data, data corruption, or complete control over the database.
Yes, patches are available in versions 4.1.12, 4.2.9, 4.3.6, and 4.4.2. It is recommended to update to one of these versions.
As a workaround, restrict access to the XMLDB editor tool to trusted users only until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
