{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\""}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2009-12-16T01:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://docs.moodle.org/en/Moodle_1.9.7_release_notes"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://docs.moodle.org/en/Moodle_1.8.11_release_notes"}, {"name": "ADV-2009-3455", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/3455"}, {"name": "37614", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/37614"}, {"name": "FEDORA-2009-13065", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html"}, {"name": "FEDORA-2009-13040", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html"}, {"name": "FEDORA-2009-13080", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html"}, {"name": "37244", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/37244"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://moodle.org/mod/forum/discuss.php?d=139120"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2009-4305", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://docs.moodle.org/en/Moodle_1.9.7_release_notes", "refsource": "CONFIRM", "url": "http://docs.moodle.org/en/Moodle_1.9.7_release_notes"}, {"name": "http://docs.moodle.org/en/Moodle_1.8.11_release_notes", "refsource": "CONFIRM", "url": "http://docs.moodle.org/en/Moodle_1.8.11_release_notes"}, {"name": "ADV-2009-3455", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/3455"}, {"name": "37614", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/37614"}, {"name": "FEDORA-2009-13065", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html"}, {"name": "FEDORA-2009-13040", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html"}, {"name": "FEDORA-2009-13080", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html"}, {"name": "37244", "refsource": "BID", "url": "http://www.securityfocus.com/bid/37244"}, {"name": "http://moodle.org/mod/forum/discuss.php?d=139120", "refsource": "CONFIRM", "url": "http://moodle.org/mod/forum/discuss.php?d=139120"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T07:01:20.299Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://docs.moodle.org/en/Moodle_1.9.7_release_notes"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://docs.moodle.org/en/Moodle_1.8.11_release_notes"}, {"name": "ADV-2009-3455", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2009/3455"}, {"name": "37614", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/37614"}, {"name": "FEDORA-2009-13065", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html"}, {"name": "FEDORA-2009-13040", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html"}, {"name": "FEDORA-2009-13080", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html"}, {"name": "37244", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/37244"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://moodle.org/mod/forum/discuss.php?d=139120"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-4305", "datePublished": "2009-12-16T01:00:00Z", "dateReserved": "2009-12-11T00:00:00Z", "dateUpdated": "2024-09-16T23:26:30.631Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:1.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "492A28FE-A2F8-4FF7-AC5B-0C3F5508506D", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.2:*:*:*:*:*:*:*", "matchCriteriaId": "28A897CA-3D8F-4575-BBD2-1C0C5A2ECC99", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.3:*:*:*:*:*:*:*", "matchCriteriaId": "A4A3A5D9-D96E-46B3-AC22-25045564EB96", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.4:*:*:*:*:*:*:*", "matchCriteriaId": "AF91F8EA-1737-4E11-9931-ACAFB4BC0018", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.5:*:*:*:*:*:*:*", "matchCriteriaId": "1E81E148-5710-439C-8A1A-884D27640AAD", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.7:*:*:*:*:*:*:*", "matchCriteriaId": "DE2C0217-A25A-4D0A-8CC6-64DEBC9E198F", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.8:*:*:*:*:*:*:*", "matchCriteriaId": "7949FC50-81B9-44AD-BB1B-91D025B34FF6", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.9:*:*:*:*:*:*:*", "matchCriteriaId": "83AA5D08-CF62-45A8-A8FE-18F76BA8ECA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.10:*:*:*:*:*:*:*", "matchCriteriaId": "2C61F076-71AC-4AEF-BECF-9EF0B05CEB77", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.1:*:*:*:*:*:*:*", "matchCriteriaId": "24F2602B-8ED3-4026-A9A4-31BE8BDC7724", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.2:*:*:*:*:*:*:*", "matchCriteriaId": "D7F24649-B67F-4809-9F54-7B623AEF5A4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.3:*:*:*:*:*:*:*", "matchCriteriaId": "6B81655E-C3B5-4115-A4C4-B7AC2FCDAB7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.4:*:*:*:*:*:*:*", "matchCriteriaId": "ED9C3840-66BE-47EC-9F0C-E9D2171FF0B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.5:*:*:*:*:*:*:*", "matchCriteriaId": "DBD062EB-1B1F-4DC8-A4F9-C2EC7D401E9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.6:*:*:*:*:*:*:*", "matchCriteriaId": "291F73E9-1059-4E7F-860F-0DF2A35AA456", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\""}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n en el m\u00f3dulo SCORM en Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a la v1.9.7 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a trav\u00e9s de de vectores relacionados con un \"asunto de escapado cuando se procesa un fichero AICC CRS (Course_Title).\""}], "id": "CVE-2009-4305", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-12-16T01:30:00.547", "references": [{"source": "[email protected]", "tags": ["Patch"], "url": "http://docs.moodle.org/en/Moodle_1.8.11_release_notes"}, {"source": "[email protected]", "tags": ["Patch"], "url": "http://docs.moodle.org/en/Moodle_1.9.7_release_notes"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "http://moodle.org/mod/forum/discuss.php?d=139120"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/37614"}, {"source": "[email protected]", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/37244"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2009/3455"}, {"source": "[email protected]", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html"}, {"source": "[email protected]", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html"}, {"source": "[email protected]", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://docs.moodle.org/en/Moodle_1.8.11_release_notes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://docs.moodle.org/en/Moodle_1.9.7_release_notes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://moodle.org/mod/forum/discuss.php?d=139120"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/37614"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/37244"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2009/3455"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "[email protected]", "type": "Primary"}]}

{"bugzilla": {"description": "Moodle: Multiple security fixes in 1.9.7 and 1.8.11 upstream releases", "id": "544766", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=544766"}, "csaw": false, "details": ["SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\""], "name": "CVE-2009-4305", "public_date": "2009-11-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2009-4305"], "threat_severity": "Moderate"}