A SQL injection flaw exists in the Moodle Socialwall plugin when it is at version 3.0 through 3.3. By inserting malicious SQL into crafted HTTP requests, an attacker can manipulate database queries in a way that results in the execution of arbitrary code on the web server. The vulnerability directly compromises the confidentiality, integrity, and availability of the affected Moodle site.

The flaw affects Moodle’s Socialwall plugin, versions 3.0, 3.1, 3.2 and 3.3. No other Moodle components are listed as affected.

The attack vector is inferred to be remote, leveraging normal HTTP requests to the plugin’s endpoints. Although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the CVSS score of 9.8 indicates an extremely high severity risk and its potential to execute arbitrary code. The absence of an official patch or workaround makes the exploitation likelihood uncertain but likely for attackers who can reach the vulnerable URLs.