{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\""}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2009-12-16T01:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://docs.moodle.org/en/Moodle_1.9.7_release_notes"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://docs.moodle.org/en/Moodle_1.8.11_release_notes"}, {"name": "ADV-2009-3455", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/3455"}, {"name": "37614", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/37614"}, {"name": "FEDORA-2009-13065", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html"}, {"name": "FEDORA-2009-13040", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html"}, {"name": "FEDORA-2009-13080", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html"}, {"name": "37244", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/37244"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://moodle.org/mod/forum/discuss.php?d=139120"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-4305", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://docs.moodle.org/en/Moodle_1.9.7_release_notes", "refsource": "CONFIRM", "url": "http://docs.moodle.org/en/Moodle_1.9.7_release_notes"}, {"name": "http://docs.moodle.org/en/Moodle_1.8.11_release_notes", "refsource": "CONFIRM", "url": "http://docs.moodle.org/en/Moodle_1.8.11_release_notes"}, {"name": "ADV-2009-3455", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/3455"}, {"name": "37614", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/37614"}, {"name": "FEDORA-2009-13065", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html"}, {"name": "FEDORA-2009-13040", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html"}, {"name": "FEDORA-2009-13080", "refsource": "FEDORA", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html"}, {"name": "37244", "refsource": "BID", "url": "http://www.securityfocus.com/bid/37244"}, {"name": "http://moodle.org/mod/forum/discuss.php?d=139120", "refsource": "CONFIRM", "url": "http://moodle.org/mod/forum/discuss.php?d=139120"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T07:01:20.299Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://docs.moodle.org/en/Moodle_1.9.7_release_notes"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://docs.moodle.org/en/Moodle_1.8.11_release_notes"}, {"name": "ADV-2009-3455", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2009/3455"}, {"name": "37614", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/37614"}, {"name": "FEDORA-2009-13065", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html"}, {"name": "FEDORA-2009-13040", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html"}, {"name": "FEDORA-2009-13080", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html"}, {"name": "37244", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/37244"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://moodle.org/mod/forum/discuss.php?d=139120"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-4305", "datePublished": "2009-12-16T01:00:00Z", "dateReserved": "2009-12-11T00:00:00Z", "dateUpdated": "2024-09-16T23:26:30.631Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:1.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "492A28FE-A2F8-4FF7-AC5B-0C3F5508506D", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.2:*:*:*:*:*:*:*", "matchCriteriaId": "28A897CA-3D8F-4575-BBD2-1C0C5A2ECC99", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.3:*:*:*:*:*:*:*", "matchCriteriaId": "A4A3A5D9-D96E-46B3-AC22-25045564EB96", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.4:*:*:*:*:*:*:*", "matchCriteriaId": "AF91F8EA-1737-4E11-9931-ACAFB4BC0018", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.5:*:*:*:*:*:*:*", "matchCriteriaId": "1E81E148-5710-439C-8A1A-884D27640AAD", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.7:*:*:*:*:*:*:*", "matchCriteriaId": "DE2C0217-A25A-4D0A-8CC6-64DEBC9E198F", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.8:*:*:*:*:*:*:*", "matchCriteriaId": "7949FC50-81B9-44AD-BB1B-91D025B34FF6", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.9:*:*:*:*:*:*:*", "matchCriteriaId": "83AA5D08-CF62-45A8-A8FE-18F76BA8ECA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.10:*:*:*:*:*:*:*", "matchCriteriaId": "2C61F076-71AC-4AEF-BECF-9EF0B05CEB77", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.1:*:*:*:*:*:*:*", "matchCriteriaId": "24F2602B-8ED3-4026-A9A4-31BE8BDC7724", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.2:*:*:*:*:*:*:*", "matchCriteriaId": "D7F24649-B67F-4809-9F54-7B623AEF5A4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.3:*:*:*:*:*:*:*", "matchCriteriaId": "6B81655E-C3B5-4115-A4C4-B7AC2FCDAB7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.4:*:*:*:*:*:*:*", "matchCriteriaId": "ED9C3840-66BE-47EC-9F0C-E9D2171FF0B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.5:*:*:*:*:*:*:*", "matchCriteriaId": "DBD062EB-1B1F-4DC8-A4F9-C2EC7D401E9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.6:*:*:*:*:*:*:*", "matchCriteriaId": "291F73E9-1059-4E7F-860F-0DF2A35AA456", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\""}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n en el m\u00f3dulo SCORM en Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a la v1.9.7 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a trav\u00e9s de de vectores relacionados con un \"asunto de escapado cuando se procesa un fichero AICC CRS (Course_Title).\""}], "id": "CVE-2009-4305", "lastModified": "2020-12-01T14:43:53.067", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-12-16T01:30:00.547", "references": [{"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://docs.moodle.org/en/Moodle_1.8.11_release_notes"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://docs.moodle.org/en/Moodle_1.9.7_release_notes"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://moodle.org/mod/forum/discuss.php?d=139120"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/37614"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/37244"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2009/3455"}, {"source": "cve@mitre.org", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html"}, {"source": "cve@mitre.org", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html"}, {"source": "cve@mitre.org", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "Moodle: Multiple security fixes in 1.9.7 and 1.8.11 upstream releases", "id": "544766", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=544766"}, "csaw": false, "details": ["SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\""], "name": "CVE-2009-4305", "public_date": "2009-11-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2009-4305\nhttps://nvd.nist.gov/vuln/detail/CVE-2009-4305"], "threat_severity": "Moderate"}