CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-4785
https://notcve.org/view.php?id=CVE-2006-4785
SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insert_record function, which calls _adodb_column_sql in the adodb layer (lib/adodb/adodb-lib.inc.php), which does not convert the data type to an int. Vulnerabilidad de inyección SQL en el blog/edit.php del Moodle 1.6.1 y anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro format como el almacenado en la variable $blogEntry, lo que no es correctamente manejado por la función insert_record, lo que llama al _adodb_column_sql en la capa adodb (lib/adodb/adodb-lib.inc.php), y no convierte este tipo de datos a un entero (int). • http://docs.moodle.org/en/Release_notes#Moodle_1.6.2 http://secunia.com/advisories/21899 http://securitytracker.com/id?1016877 http://www.attrition.org/pipermail/vim/2006-September/001038.html http://www.attrition.org/pipermail/vim/2006-September/001040.html http://www.securityfocus.com/archive/1/446227/100/0/threaded http://www.securityfocus.com/bid/19995 http://www.securityfocus.com/bid/20085 http://www.vupen.com/english/advisories/2006/3591 https://exchange.xforce.ibmcl • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 15EXPL: 0CVE-2005-2247
https://notcve.org/view.php?id=CVE-2005-2247
Multiple unknown vulnerabilities in Moodle before 1.5.1 have unknown impact and attack vectors. • http://moodle.org/doc/?frame=release.html http://secunia.com/advisories/16028 •