CVE-2013-4313
Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not...
Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.
Exploit likelihood
What each source reports
NVD Score used
Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.
- Record
CVE-2013-4313- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.
- Record
CVE-2013-4313- Updated
- 2026-11-02
EUVDEUVD-2013-4206 No score
Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.
- Record
EUVD-2013-4206- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gxf9-5xr3-34cc No score
Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not...
Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.
- Record
GHSA-gxf9-5xr3-34cc- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVMGASA-2013-0280 No score
Updated moodle package fixes multiple security vulnerabilities
Updated moodle package fixes security vulnerabilities:
Null characters were allowed in query strings in Moodle before 2.4.6, which caused sql statements to terminate and fail, potentially allowing sql injection in Moodle's SQL Server driver (CVE-2013-4313).
Links to external blogs were not being adequately cleaned in Moodle before 2.4.6, potentially allowing for XSS attacks (CVE-2013-4341).
- Record
MGASA-2013-0280- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4313 No score
Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.
- Record
UBUNTU-CVE-2013-4313- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodleMageia:3 From an advisory covering 2 CVEs |
before 2.4.6-1.mga3 | 2.4.6-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4313 is a high vulnerability (CVSS 7.5) in Moodle, published September 16, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.21%, the 68th percentile. No source names a fixed version.