Details
-
Type:
Bug
-
Status:
Closed
-
Priority:
Critical
-
Resolution: Fixed
-
Affects Version/s: 1.8.2
-
Fix Version/s: 1.8
-
Component/s: Block: Mrbs
-
Labels:None
-
Environment:Uncertain
-
Database:Any
-
Affected Branches:MOODLE_18_STABLE
-
Fixed Branches:MOODLE_18_STABLE
Description
Hi,
A colleague passed along the following link to a potential security issue with Moodle 1.8.2. We cannot locate this "ing/blocks/mrdb/" path, so are not certain where in the stack the issue may surface, if at all. Might this be an add-on? (Apologies if this is a repeat of another issue: I did a search and could not find it.)
http://www.securityfocus.com/archive/1/485434
PATH/moodle/ing/blocks/mrbs/code/web/view_entry.php?id=[SQL]&day=27&month=10&year=2007
And a POC:
PATH/moodle/ing/blocks/mrbs/code/web/view_entry.php?id=2000%20UNION%20SELECT%20username,id,id,id,id,id,id,id,id,id,id,id%20FROM%20mdl_user%20WHERE%20id=[ID]&day=27&month=10&year=2007
Thanks,
Jim
James - There was a SQL injection vulnerability with the MRBS (a contributed, aka: 3rd party) block. The vulnerability has been patched in the MRBS block and I have notified the developer of the MRBS program of the vulnerability. Moodle traditionally has done very well at avoiding SQL injection attacks and the patch utilizes Moodle functions designed to help avoid such vulnerabilities. Those using the MRBS block should upgrade to the latest version which patches the vulnerabilities listed in the report you have provided. Please feel free to let me know if you have any questions about how to upgrade the MRBS block. Peace - Anthony