Bug 2563954 (CVE-2026-119554)
| Summary: | CVE-2026-119554 moodle: moodle: SQL injection in External database enrolment plugin via course ID number | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Moodle's External database enrolment plugin. This vulnerability allows an authenticated attacker with course editing privileges to inject malicious SQL (Structured Query Language) commands through the course identification number field. During scheduled synchronization with external databases, these commands execute, potentially leading to unauthorized information disclosure and modification of enrollment records.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2565546, 2565547, 2565548 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-30 12:13:02 UTC
|