SQL Injection Vulnerability in Moodle by Moodle
CVE-2023-28329
Key Information:
Badges
What is CVE-2023-28329?
The vulnerability arises from insufficient validation of the availability condition for profile fields in Moodle, potentially allowing unauthorized access to sensitive data through SQL injection. By default, this risk is primarily available to users with teacher or manager roles, which raises significant concerns about the security of user information and the integrity of data. It is crucial for affected users to apply security updates promptly to mitigate the risks associated with this vulnerability.
Affected Version(s)
moodle 4.1 to 4.1.1, 4.0 to 4.0.6, 3.11 to 3.11.12, 3.9 to 3.9.19 and earlier unsupported versions
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.