CVE-2012-3395: SQL Injection
Published Jul 23, 2012
·Updated
SQL injection vulnerability in mod/feedback/complete.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to execute arbitrary SQL commands via crafted form data.
Affected Software
21 affected components
Moodle moodle=2.0.0
Moodle moodle=2.0.1
Moodle moodle=2.0.2
Moodle moodle=2.0.3
Moodle moodle=2.0.4
Moodle moodle=2.0.5
Moodle moodle=2.0.6
Moodle moodle=2.0.7
Moodle moodle=2.0.8
Moodle moodle=2.0.9
Moodle moodle=2.1.0
Moodle moodle=2.1.1
Moodle moodle=2.1.2
Moodle moodle=2.1.3
Moodle moodle=2.1.4
Moodle moodle=2.1.5
Moodle moodle=2.1.6
Moodle moodle=2.2.0
Moodle moodle=2.2.1
Moodle moodle=2.2.2
Moodle moodle=2.2.3
Event History
Jul 23, 2012
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-3395?
CVE-2012-3395 has a moderate severity rating due to its potential for SQL injection attacks.
2
How do I fix CVE-2012-3395?
To fix CVE-2012-3395, upgrade Moodle to the versions 2.0.10, 2.1.7, or 2.2.4 or later.
3
What types of software are affected by CVE-2012-3395?
CVE-2012-3395 affects Moodle versions 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4.
4
Can remote authenticated users exploit CVE-2012-3395?
Yes, remote authenticated users can exploit CVE-2012-3395 to execute arbitrary SQL commands.
5
What is the root cause of CVE-2012-3395?
The root cause of CVE-2012-3395 is improper handling of crafted form data in the mod/feedback/complete.php script.