CVE-2005-3648: SQL Injection
Multiple SQL injection vulnerabilities in the getrecord function in datalib.php in Moodle 1.5.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) category.php and (2) info.php.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-3648?
CVE-2005-3648 is considered a high-severity vulnerability due to the potential for remote SQL injection attacks.
How can I fix CVE-2005-3648?
To fix CVE-2005-3648, upgrade Moodle to version 1.5.3 or later, which addresses the SQL injection vulnerabilities.
What are the attack vectors for CVE-2005-3648?
The attack vectors for CVE-2005-3648 are the id parameters in category.php and info.php in Moodle 1.5.2.
Who is affected by CVE-2005-3648?
Users of Moodle version 1.5.2 are affected by CVE-2005-3648 due to the vulnerabilities in the get_record function.
What could an attacker achieve with CVE-2005-3648?
An attacker could exploit CVE-2005-3648 to execute arbitrary SQL commands on the Moodle database, potentially compromising data integrity.