Moodle 5.3.0 and earlier releases contain a SQL injection flaw in the enrol_database plugin that allows a teacher with editing privilege to inject a backslash‑quote payload into the course idnumber field. During scheduled synchronisation with an external MySQL or MariaDB database, the payload is executed, enabling the attacker to read arbitrary data from the external database and manipulate enrolment records. This is a classic injection flaw matching CWE‑89 and can result in data exposure and integrity compromise.

Customers running Moodle Project Moodle versions 4.5.15, 5.0.0‑5.0.11, 5.1.0‑5.1.8, 5.2.0‑5.2.4, or 5.3.0 are affected. The vulnerability exists in the external database enrolment plugin across all these releases.

The vulnerability has a CVSS base score of 6, indicating moderate severity. EPSS data is not available, and the issue is not listed in CISA's KEV catalog, suggesting no widespread exploitation yet. The attack requires a teacher to edit a course idnumber and the system must have the external database enrolment plugin configured; thus the attack vector is common web access with teacher credentials. If the conditions are met, an attacker could read data from the external database and alter enrolment, presenting a moderate to high risk for institutions that rely on sensitive user data.