The vulnerability is an SQL injection flaw in the report_sql::prepare_sql() method of the Configurable Reports block for Moodle. The flaw occurs when the filter_var request parameter of viewreport.php is not sanitized, allowing even low‑privileged users engaged in report viewing to inject arbitrary SQL. Successful exploitation lets an attacker read any table in the Moodle database, including tables containing user identifiers and password hashes, thereby compromising data confidentiality.

The affected component is the Moodle Configurable Reports block (moodle-block_configurablereports) from vendor jleyva. Versions before 5.3.1 are vulnerable; the fix is applied in release 5.3.1 and later. Systems running Moodle with the block 5.x series should review their installed version and upgrade if necessary.

The CVSS score of 6 indicates a medium severity vulnerability. No EPSS score is publicly available, so the current likelihood of exploitation is uncertain, but the absence of a KEV listing does not preclude real‑world abuse. The attack path requires a web request to viewreport.php with a crafted filter_var value, which can be initiated by any logged‑in user with report access. Because the injected code can read password hashes, a successful attack could lead to credential compromise, account hijacking, and broader system compromise if users reuse passwords or weak accounts exist.