PT-2022-6698 · Moodle+2 · Moodle+2

Paul Holden · Published 2022-01-17 · Updated 2024-03-06 · CVE-2022-0332

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moodle versions 3.11 to 3.11.4

Description A flaw was found in the h5p activity web service of Moodle, which is responsible for fetching user attempt data. This flaw is related to insufficient protection of the SQL query structure, allowing for SQL injection. The vulnerability can be exploited by a remote attacker to execute arbitrary SQL queries in the database, potentially leading to reading, deleting, or modifying data in the database and gaining full control over the vulnerable application.

Recommendations For Moodle versions 3.11 to 3.11.4, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2022-1064

ALT-PU-2022-1476

ALT-PU-2022-1641

ALT-PU-2022-2450

BDU:2023-03479

BIT-MOODLE-2022-0332

CVE-2022-0332

GHSA-6JHM-4VMX-MR76

Affected Products

Alt Linux

Moodle

Red Os

References · 22

• 🔥 https://github.com/numanturle/CVE-2022-0332 · Exploit
• 🔥 https://exploit-db.com/exploits/50700 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0332 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0332 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03479 · Security Note
• https://ubuntu.com/security/CVE-2022-0332 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6jhm-4vmx-mr76 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=431099 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0332 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0332 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2022-0332 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/674419 · Security Note
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/c7a62a8c82219b50589257f79021da1df1a76808 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2043661 · Note