CVE-2016-7919: SQL Injection
DISPUTED Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component. NOTE: the vendor disputes the relevance of this report, noting that "the person who is installing Moodle must know database access credentials and they can access the database directly; there is no need for them to create a SQL injection in one of the installation dialogue fields."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7919?
CVE-2016-7919 is considered to involve a potential SQL Injection vulnerability that could lead to sensitive information disclosure.
How can I mitigate CVE-2016-7919?
To mitigate CVE-2016-7919, ensure that you apply the latest security patches provided by Moodle for version 3.1.2.
Which version of Moodle is affected by CVE-2016-7919?
Moodle version 3.1.2 is affected by CVE-2016-7919.
Is CVE-2016-7919 a confirmed vulnerability?
The vendor disputes the relevance of CVE-2016-7919, stating that the issue may not impact the installation process.
What should I do if I suspect exploitation of CVE-2016-7919?
If you suspect exploitation of CVE-2016-7919, it is recommended to conduct a security audit of your Moodle instance and review logs for unusual activity.