{"id":"CVE-2009-4305","aliases":["DSA-1986-1","EUVD-2009-4273","GHSA-7w7p-v23v-56qr"],"status":"published","title":"SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7...","description":"SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\"","severity":{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01912,"percentile":0.79953,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2009-12-16T01:00:00Z","modified":"2026-06-16T23:13:24Z","affected":[{"source":"osv","ecosystem":"Debian:5.0","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2.dfsg-3+lenny3"}]}],"versions":["1.8.2.dfsg-3","1.8.2.dfsg-3+lenny1","1.8.2.dfsg-3+lenny2"],"bundled":7}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://docs.moodle.org/en/Moodle_1.9.7_release_notes","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://docs.moodle.org/en/Moodle_1.8.11_release_notes","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.vupen.com/english/advisories/2009/3455","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/37614","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.securityfocus.com/bid/37244","tags":["vdb-entry","x_refsource_BID","x_transferred","Patch"]},{"url":"http://moodle.org/mod/forum/discuss.php?d=139120","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4305"},{"url":"https://github.com/advisories/GHSA-7w7p-v23v-56qr"}],"sources":{"cve":[{"id":"CVE-2009-4305","description":"SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\"","status":"published","published":"2009-12-16T01:00:00Z","modified":"2024-09-16T23:26:30.631Z","updated_at":"2026-11-02T14:33:24.782697Z"}],"euvd":[{"id":"EUVD-2009-4273","description":"SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\"","status":"published","published":"2009-12-16T01:00:00Z","modified":"2024-09-16T23:26:30Z","updated_at":"2026-11-03T00:54:50.364031Z"}],"ghsa":[{"id":"GHSA-7w7p-v23v-56qr","title":"SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7...","description":"SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\"","status":"published","published":"2022-05-02T03:53:32Z","modified":"2023-01-31T05:08:12Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:49:21.399059Z"}],"nvd":[{"id":"CVE-2009-4305","description":"SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an \"escaping issue when processing AICC CRS file (Course_Title).\"","status":"published","published":"2009-12-16T01:30:00.547Z","modified":"2026-06-16T23:13:24.35Z","cvss":[{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:01:37.939838Z"}],"osv":[{"id":"DSA-1986-1","title":"moodle - several vulnerabilities","status":"published","published":"2010-02-02T00:00:00Z","modified":"2026-03-09T01:21:27.020963Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}