Description

Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.

Remediation

References

CVE-2010-1615

Related Vulnerabilities

WordPress Plugin Jetpack-WP Security, Backup, Speed, & Growth Cross-Site Scripting (4.0.2)

Oracle JRE CVE-2013-5830 Vulnerability (CVE-2013-5830)

MySQL CVE-2017-10284 Vulnerability (CVE-2017-10284)

Zope Web Application Server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-32633)

PrestaShop Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-43789)

Severity

High

Classification

CVE-2010-1615 CWE-138

Tags

Missing Update Known Vulnerabilities