Live › vulnerability › CVE-2026-113608
Go to dashboardThe Configurable Reports block for Moodle before 5.3.1 has an SQL injection flaw in report_sql::prepare_sql() reached through the filter_var parameter of viewreport.php. A low-privileged user who can view a report using the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Moodle sites running the Configurable Reports block before 5.3.1 where reports use the %%FILTER_VAR%% placeholder and some users can view those reports. The exposure depends on that placeholder being in use and on users with low privileges having report view access. Sites without the block, or on 5.3.1 or later, are not affected.
No product ranges from the sources yet.
version.php in the blocks/configurablereports directory.%%FILTER_VAR%% placeholder in their SQL.5.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.
This page as .md · .json · in your agent: get_signal("CVE-2026-113608")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.