Description
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Moodle Project | moodle | 5.3.0, 5.2.0 – ≤ 5.2.4, 5.1.0 – ≤ 5.1.8, 5.0.0 – ≤ 5.0.11, ≤ 4.5.15 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | moodle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | moodle | No fix yet | — |
Advisories 1
- WID-SEC-2026-4274 Moodle: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 1, 2026
References
- https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L918-L926 technical-description
- https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L971-L979 technical-description
- https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L527-L528 technical-description
- https://abraxaslabs.tech/research/moodle-enrol-database-sqli third-party-advisory
- https://github.com/moodle/moodle product
- VulnCheck Advisory: Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber third-party-advisory