PT-2010-3285 · Moodle · Moodle

Published 2010-04-29 · Updated 2022-05-13 · CVE-2010-1615

Positive Technologies (AI Summary)

CVSS v4.0

8.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Moodle versions 1.8.x through 1.8.11 Moodle versions 1.9.x through 1.9.7

Description The issue allows remote attackers to execute arbitrary SQL commands. This is related to vectors such as the add to log function in mod/wiki/view.php in the wiki module, or data validation in some forms elements related to lib/form/selectgroups.php.

Recommendations For Moodle versions 1.8.x through 1.8.11, update to version 1.8.12 or later. For Moodle versions 1.9.x through 1.9.7, update to version 1.9.8 or later.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-1615

DSA-2115-1

GHSA-9XP2-5FR9-7MWM

Affected Products

Moodle

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2010-1615 · Security Note
• https://osv.dev/vulnerability/GHSA-9xp2-5fr9-7mwm · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html · Vendor Advisory
• https://github.com/moodle/moodle · Note
• http://moodle.org/security · Note
• http://vupen.com/english/advisories/2010/1107 · Note
• http://cvs.moodle.org/moodle/lib/form/selectgroups.php?r1=1.2.4.2&r2=1.2.4.3 · Note
• http://cvs.moodle.org/moodle/mod/wiki/view.php?r1=1.76.2.6&r2=1.76.2.7 · Note