Description
SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insert_record function, which calls _adodb_column_sql in the adodb layer (lib/adodb/adodb-lib.inc.php), which does not convert the data type to an int.
Remediation
References
Related Vulnerabilities
WordPress Plugin Adminimize 'page' Parameter Cross-Site Scripting (1.7.21)
Magento XML Injection (aka Blind XPath Injection) Vulnerability (CVE-2021-21025)
WordPress Plugin Ajax Search Lite Remote Command Execution (3.1)
WordPress Plugin Simple Security Multiple Cross-Site Scripting Vulnerabilities (1.1.5)