Description
Multiple SQL injection vulnerabilities in the get_record function in datalib.php in Moodle 1.5.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) category.php and (2) info.php.
References
- ADV-2005-2387 vdb-entry
- 20051110 Moodle <=1.6dev blind SQL Injection mailing-list
- 15380 vdb-entry
- http://rgod.altervista.org/moodle16dev.html
- 20748 vdb-entry
- 17526 third-party-advisory
- moodle-multi-scripts-sql-injection(23058) vdb-entry
- 1015181 vdb-entry