Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2... · CVE-2013-4313 · GitHub Advisory Database · GitHub

Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2...

High severity Unreviewed Published May 13, 2022 to the GitHub Advisory Database • Updated Feb 1, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.

References

Published by the National Vulnerability Database

Sep 16, 2013

Published to the GitHub Advisory Database May 13, 2022

Last updated Feb 1, 2023