CVE-2026-119554

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://abraxaslabs.tech/research/moodle-enrol-database-sqli
https://github.com/moodle/moodle
https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L527-L528
https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L918-L926
https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L971-L979
https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and-4.5.15-sql-injection-via-enrol-database-course-idnumber

Configurations

No configuration.

History

30 Oct 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-30 12:16

Updated : 2026-10-30 19:14

NVD link : CVE-2026-119554

Mitre link : CVE-2026-119554

CVE.ORG link : CVE-2026-119554

JSON object : View

Products Affected

No product.

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-119554", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/moodle/moodle", "vendor": "Moodle Project", "product": "moodle", "versions": [{"status": "affected", "version": "5.3.0", "versionType": "semver"}, {"status": "affected", "version": "5.2.0", "versionType": "semver", "lessThanOrEqual": "5.2.4"}, {"status": "affected", "version": "5.1.0", "versionType": "semver", "lessThanOrEqual": "5.1.8"}, {"status": "affected", "version": "5.0.0", "versionType": "semver", "lessThanOrEqual": "5.0.11"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.5.15"}], "packageURL": "pkg:github/moodle/moodle", "packageName": "moodle", "collectionURL": "https://git.moodle.org", "defaultStatus": "unaffected"}]}], "published": "2026-10-30T12:16:42.423", "references": [{"url": "https://abraxaslabs.tech/research/moodle-enrol-database-sqli", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/moodle/moodle", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L527-L528", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L918-L926", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L971-L979", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and-4.5.15-sql-injection-via-enrol-database-course-idnumber", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results."}], "lastModified": "2026-10-30T19:14:38.697", "sourceIdentifier": "disclosure@vulncheck.com"}