Lucene search

MitreCVE-2008-6124

HistoryFeb 13, 2009 - 1:30 a.m.

CVE-2008-6124

2009-02-1301:30:00

CWE-89

mitre

web.nvd.nist.gov

sql injection

hotpot module

moodle

remote attackers

nvd

cve-2008-6124

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8.3

Confidence

Low

EPSS

0.001

Percentile

49.2%

JSON

SQL injection vulnerability in the hotpot_delete_selected_attempts function in report.php in the HotPot module in Moodle 1.6 before 1.6.7, 1.7 before 1.7.5, 1.8 before 1.8.6, and 1.9 before 1.9.2 allows remote attackers to execute arbitrary SQL commands via a crafted selected attempt.

Affected configurations

Nvd

Node

moodlemoodleRange1.6–1.6.7

moodlemoodleRange1.7–1.7.5

moodlemoodleRange1.8–1.8.6

moodlemoodleRange1.9–1.9.2

Node

debiandebian_linuxMatch4.0

VendorProductVersionCPE
moodlemoodle*cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
debiandebian_linux4.0cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
moodle	moodle	*	cpe:2.3:a:moodle:moodle::::::::
debian	debian_linux	4.0	cpe:2.3:o:debian:debian_linux:4.0:::::::*

References

cvs.moodle.org/moodle/mod/hotpot/report.php?r1=1.8.6.1&r2=1.8.6.2

moodle.org/mod/forum/discuss.php?d=101402

www.debian.org/security/2008/dsa-1691

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8.3

Confidence

Low

EPSS

0.001

Percentile

49.2%

JSON

Related for CVE-2008-6124