SQL Injection Vulnerability in Configurable Reports Block for Moodle

CVE-2026-113608

What is CVE-2026-113608?

The Configurable Reports block in Moodle prior to version 5.3.1 contains an SQL injection vulnerability in the report_sql::prepare_sql() function. This flaw allows low-privileged users to exploit the filter_var request parameter in viewreport.php. By utilizing the %%FILTER_VAR%% placeholder, attackers can perform subqueries or UNION SELECT statements, enabling them to access and extract sensitive data from arbitrary database tables, including user password hashes. Admins should update immediately to protect sensitive data.

References