PT-2016-7433 · Moodle · Moodle

José Domingo Carrillo · Published 2016-10-28 · Updated 2024-08-06 · CVE-2016-7919

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle version 3.1.2

Description The issue allows remote attackers to obtain sensitive information via unspecified vectors, related to a SQL Injection issue affecting the Administration panel function in the installation process component. The vendor disputes the relevance of this report, noting that the person installing Moodle must know database access credentials and they can access the database directly, thus there is no need for them to create a SQL injection in one of the installation dialogue fields.

Recommendations For Moodle version 3.1.2, consider restricting access to the Administration panel function in the installation process component to minimize the risk of exploitation. As a temporary workaround, avoid using the installation dialogue fields that may be vulnerable to SQL injection until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

SQL injection

Weakness Enumeration

CWE-200

CWE-89

Related Identifiers

CVE-2016-7919

Affected Products

Moodle

References · 13

• 🔥 https://youtube.com/watch?v=pQS1GdQ3CBc · Exploit
• https://ubuntu.com/security/CVE-2016-7919 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7919 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7919 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7919 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-7919 · Security Note
• https://tracker.moodle.org/browse/MDL-56298 · Note
• http://securityfocus.com/bid/93971 · Note
• https://t.me/cvenotify/80136 · Telegram Post
• https://t.me/cvenotify/89322 · Telegram Post
• https://t.me/cvenotify/87146 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7919 · Note
• https://t.me/cvenotify/88215 · Telegram Post