CVE-2012-2363: SQL Injection
Published Jul 21, 2012
·Updated
SQL injection vulnerability in calendar/event.php in the calendar implementation in Moodle 1.9.x before 1.9.18 allows remote authenticated users to execute arbitrary SQL commands via a crafted calendar event.
Affected Software
17 affected components
Moodle moodle=1.9.1
Moodle moodle=1.9.2
Moodle moodle=1.9.3
Moodle moodle=1.9.4
Moodle moodle=1.9.5
Moodle moodle=1.9.6
Moodle moodle=1.9.7
Moodle moodle=1.9.8
Moodle moodle=1.9.9
Moodle moodle=1.9.10
Moodle moodle=1.9.11
Moodle moodle=1.9.12
Moodle moodle=1.9.13
Moodle moodle=1.9.14
Moodle moodle=1.9.15
Moodle moodle=1.9.16
Moodle moodle=1.9.17
Event History
Jul 21, 2012
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-2363?
CVE-2012-2363 is considered a medium severity vulnerability due to its potential to allow unauthorized SQL command execution.
2
How do I fix CVE-2012-2363?
To fix CVE-2012-2363, upgrade Moodle to version 1.9.18 or later, where the vulnerability has been addressed.
3
Who is affected by CVE-2012-2363?
CVE-2012-2363 affects authenticated users of Moodle versions 1.9.x prior to 1.9.18.
4
What type of vulnerability is CVE-2012-2363?
CVE-2012-2363 is an SQL injection vulnerability that allows execution of arbitrary SQL commands.
5
What impacts can CVE-2012-2363 have on my system?
If exploited, CVE-2012-2363 can lead to unauthorized data access and manipulation in the Moodle database.