PT-2026-118468 · Jleyva · Moodle-Block Configurablereports
CVE-2026-113608
·
Published
2026-10-20
·
Updated
2026-10-20
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Configurable Reports block for Moodle (moodle-block configurablereports) before 5.3.1 contains an sql injection vulnerability in report sql::prepare sql() via the filter var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Moodle-Block Configurablereports