CVE-2010-1615
Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.72% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- moodle/moodle
- Source
- cve@mitre.org
References
- http://cvs.moodle.org/moodle/lib/form/selectgroups.php?r1=1.2.4.2&r2=1.2.4.3
- http://cvs.moodle.org/moodle/mod/wiki/view.php?r1=1.76.2.6&r2=1.76.2.7
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://moodle.org/security/
- http://www.vupen.com/english/advisories/2010/1107
- http://cvs.moodle.org/moodle/lib/form/selectgroups.php?r1=1.2.4.2&r2=1.2.4.3
- http://cvs.moodle.org/moodle/mod/wiki/view.php?r1=1.76.2.6&r2=1.76.2.7
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://moodle.org/security/
- http://www.vupen.com/english/advisories/2010/1107
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.