CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 5.0
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: ** disputed ** moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "sql injection" issue affecting the administration panel function in the installation process component.  note: the vendor disputes the relevance of this report, noting that "the person who is installing moodle must know database access credentials and they can access the database directly; there is no need for them to create a sql injection in one of the installation dialogue fields."
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2016-10-28
Last Modified Date: 2016-12-02