{"id":"CVE-2013-4313","aliases":["EUVD-2013-4206","GHSA-gxf9-5xr3-34cc","MGASA-2013-0280","UBUNTU-CVE-2013-4313"],"status":"published","title":"Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not...","description":"Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01206,"percentile":0.6853,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2013-09-16T10:00:00Z","modified":"2026-06-16T23:57:00Z","affected":[{"source":"osv","ecosystem":"Mageia:3","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-1.mga3"}]}],"bundled":2}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-40676","tags":["x_refsource_CONFIRM","x_transferred","Patch","report"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=238396","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4313"},{"url":"https://github.com/advisories/GHSA-gxf9-5xr3-34cc"},{"url":"https://advisories.mageia.org/MGASA-2013-0280.html","tags":["advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=238399","tags":["web"]},{"url":"http://docs.moodle.org/dev/Moodle_2.4.6_release_notes","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=237413","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4313","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4313","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-4313","description":"Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.","status":"published","published":"2013-09-16T10:00:00Z","modified":"2024-09-17T03:14:06.533Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4206","description":"Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.","status":"published","published":"2013-09-16T10:00:00Z","modified":"2024-09-17T03:14:06Z","updated_at":"2026-11-03T00:28:33.372362Z"}],"ghsa":[{"id":"GHSA-gxf9-5xr3-34cc","title":"Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not...","description":"Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.","status":"published","published":"2022-05-13T01:12:53Z","modified":"2023-02-01T05:03:59Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:50:07.322817Z"}],"nvd":[{"id":"CVE-2013-4313","description":"Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.","status":"published","published":"2013-09-16T13:02:48.067Z","modified":"2026-06-16T23:57:00.57Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"MGASA-2013-0280","title":"Updated moodle package fixes multiple security vulnerabilities","description":"Updated moodle package fixes security vulnerabilities:\n\nNull characters were allowed in query strings in Moodle before 2.4.6, which\ncaused sql statements to terminate and fail, potentially allowing sql\ninjection in Moodle's SQL Server driver (CVE-2013-4313).\n\nLinks to external blogs were not being adequately cleaned in Moodle before\n2.4.6, potentially allowing for XSS attacks (CVE-2013-4341).\n","status":"published","published":"2013-09-19T09:33:27Z","modified":"2026-04-16T06:24:10.483260471Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2013-4313","description":"Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.","status":"withdrawn","published":"2013-09-16T13:02:00Z","modified":"2025-07-16T07:31:21.024662Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}