CVE-2013-4313: SQL Injection
Published Sep 16, 2013
·Updated
Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.
Affected Software
29 affected components
Moodle moodle<=2.2.11
Moodle moodle=2.2.0
Moodle moodle=2.2.1
Moodle moodle=2.2.2
Moodle moodle=2.2.3
Moodle moodle=2.2.4
Moodle moodle=2.2.5
Moodle moodle=2.2.6
Moodle moodle=2.2.7
Moodle moodle=2.2.8
Moodle moodle=2.2.9
Moodle moodle=2.2.10
Moodle moodle=2.3.0
Moodle moodle=2.3.1
Moodle moodle=2.3.2
Moodle moodle=2.3.3
Moodle moodle=2.3.4
Moodle moodle=2.3.5
Moodle moodle=2.3.6
Moodle moodle=2.3.7
Moodle moodle=2.3.8
Moodle moodle=2.4.0
Moodle moodle=2.4.1
Moodle moodle=2.4.2
Moodle moodle=2.4.3
Moodle moodle=2.4.4
Moodle moodle=2.4.5
Moodle moodle=2.5.0
Moodle moodle=2.5.1
Remediation
Patch Available
Event History
Sep 16, 2013
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-4313?
CVE-2013-4313 is classified as a medium severity vulnerability due to the potential for SQL injection attacks.
2
How do I fix CVE-2013-4313?
To fix CVE-2013-4313, update Moodle to version 2.2.12, 2.3.9, 2.4.6, or 2.5.2 or later.
3
What versions of Moodle are affected by CVE-2013-4313?
CVE-2013-4313 affects Moodle versions prior to 2.2.12, 2.3.9, 2.4.6, and 2.5.2.
4
What type of attack does CVE-2013-4313 allow?
CVE-2013-4313 allows remote attackers to perform SQL injection attacks against Microsoft SQL Server.
5
Is CVE-2013-4313 associated with SQL vulnerabilities?
Yes, CVE-2013-4313 is specifically related to vulnerabilities that could lead to SQL injection.