CVE-2026-113608: Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var
Configurable Reports block for Moodle (moodle-blockconfigurablereports) before 5.3.1 contains an sql injection vulnerability in reportsql::preparesql() via the filtervar request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTERVAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
moodle-block_configurablereportsto a version that resolves this vulnerability.Fixed in 5.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged user can exploit it if they are permitted to view a report that uses the %%FILTER_VAR%% placeholder. The issue is remotely reachable through viewreport.php, but exploitation has high attack complexity.
What data could an attacker access?
An attacker can inject subqueries or UNION SELECT statements to read arbitrary database tables. This can include Moodle user password hashes.
Which versions are affected?
Versions of the Configurable Reports block before 5.3.1 are affected. Version 5.3.1 is the referenced fixed release.
What can be done if upgrading is not immediately possible?
Restrict low-privileged users from viewing reports that use the %%FILTER_VAR%% placeholder. Review report access permissions and report definitions to identify users and reports exposed to the vulnerable parameter.