Description

SQL injection vulnerability in calendar/event.php in the calendar implementation in Moodle 1.9.x before 1.9.18 allows remote authenticated users to execute arbitrary SQL commands via a crafted calendar event.

Remediation

References

CVE-2012-2363

Related Vulnerabilities

Ruby Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2017-17790)

WordPress Plugin Lightbox Multiple Vulnerabilities (1.6.6)

PHP Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2018-10546)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-4307)

Oracle JRE CVE-2017-10347 Vulnerability (CVE-2017-10347)

Severity

Medium

Classification

CVE-2012-2363 CWE-138

Tags

Missing Update Known Vulnerabilities