CVE-2010-1615 — Vulnerability in moodle/moodle — CVE Details

HIGH

Moodle vulnerable to SQL injection

Published May 13, 2022Updated April 12, 2025Source: osv

Summary

Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.

Advisory Timeline

First published May 13, 2022 (1614 days ago).
Last revised April 12, 2025 — 1065 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer

Update moodle/moodle to 1.9.8 or later

composer require "moodle/moodle:^1.9.8"

Composer

Update moodle/moodle to 1.8.12 or later

composer require "moodle/moodle:^1.8.12"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: packagist (1).

Package	Ecosystem	Affected	Fixed In
moodle/moodle	packagist	All versions	1.9.8
moodle/moodle	packagist	All versions	1.8.12

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-89
SQL InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

Frequently Asked Questions

What is CVE-2010-1615?: Moodle vulnerable to SQL injection This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2010-1615?: CVE-2010-1615 affects moodle/moodle. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2010-1615 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-9xp2-5fr9-7mwm

Related CVEs

CVE-2021-36394
CRITICAL
Moodle Session Fixation vulnerability
CVE-2022-40314
CRITICAL
Moodle remote code execution
CVE-2022-30599
CRITICAL
SQL injection in moodle
CVE-2021-3943
CRITICAL
Moodle vulnerable to RCE via unsafe deserialization
CVE-2025-26525
HIGH
Moodle has an arbitrary file read risk through pdfTeX
CVE-2025-26530
HIGH
Moodle allows reflected XSS via question bank filter
CVE-2025-67853
HIGH
Moodle Affected by Improper Restriction of Excessive Authentication Attempts
CVE-2024-34008
HIGH
Moodle CSRF risk in analytics management of models

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies