PT-2009-1599

CVE-2008-6124

Published

2009-02-13

Updated

2018-11-08

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moodle versions 1.6 through 1.6.6 Moodle versions 1.7 through 1.7.4 Moodle versions 1.8 through 1.8.5 Moodle versions 1.9 through 1.9.1

Description The issue allows remote attackers to execute arbitrary SQL commands via a crafted selected attempt. This is due to a SQL injection vulnerability in the hotpot delete selected attempts function in report.php in the HotPot module.

Recommendations For Moodle versions 1.6 through 1.6.6, update to version 1.6.7 or later. For Moodle versions 1.7 through 1.7.4, update to version 1.7.5 or later. For Moodle versions 1.8 through 1.8.5, update to version 1.8.6 or later. For Moodle versions 1.9 through 1.9.1, update to version 1.9.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Petr Skoda

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2008-6124