{"id":"CVE-2026-113608","kind":"vulnerability","aliases":["CVE-2026-113608"],"related":[],"title":"Moodle Configurable Reports block: SQL injection lets low-privileged users read database tables","description":"Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.","summary":"The Configurable Reports block for Moodle before 5.3.1 has an SQL injection flaw in report_sql::prepare_sql() reached through the filter_var parameter of viewreport.php. A low-privileged user who can view a report using the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lms","moodle","package","php","self-hosted"],"not_affected_if":["block-not-installed","no-filter-var-placeholder","version-5.3.1-or-later"],"how_to_check":"- Check the installed version of the block in Moodle under Site administration > Plugins > Plugins overview, or read `version.php` in the `blocks/configurablereports` directory.\n- Look for reports that use the `%%FILTER_VAR%%` placeholder in their SQL.","fix":"- Update moodle-block_configurablereports to `5.3.1` or later.","status":"open","published_at":"2026-10-20T16:17:11+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:05:45+00:00","updated_at":"2026-10-25T04:05:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:05:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update moodle-block_configurablereports to `5.3.1` or later.","reach":"internet","title":"Moodle Configurable Reports block: SQL injection lets low-privileged users read database tables","impact":"high","summary":"The Configurable Reports block for Moodle before 5.3.1 has an SQL injection flaw in report_sql::prepare_sql() reached through the filter_var parameter of viewreport.php. A low-privileged user who can view a report using the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.","category":"package","nicknames":[],"who_cares":["moodle","self-hosted","php","lms"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads arbitrary database tables, including user password hashes.","analyst_note":"Confirm the exact affected version range and whether a fixed release notice or advisory exists beyond the NVD entry.","how_to_check":"- Check the installed version of the block in Moodle under Site administration > Plugins > Plugins overview, or read `version.php` in the `blocks/configurablereports` directory.\n- Look for reports that use the `%%FILTER_VAR%%` placeholder in their SQL.","needs_analyst":true,"not_affected_if":["block-not-installed","version-5.3.1-or-later","no-filter-var-placeholder"],"who_is_affected":"Moodle sites running the Configurable Reports block before 5.3.1 where reports use the %%FILTER_VAR%% placeholder and some users can view those reports. The exposure depends on that placeholder being in use and on users with low privileges having report view access. Sites without the block, or on 5.3.1 or later, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000657,"input_tokens":3364,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113608':17A,20A '-2026':16A,19A '5.3.1':35B,94C 'arbitrari':77B,134C 'block':4A,31B,86C,91C 'configur':2A,29B,84C 'configurablereport':92C 'contain':95C 'cve':15A,18A 'databas':13A,78B,135C 'filter':49B,66B,107C,123C 'flaw':40B 'hash':83B,140C 'host':27B 'includ':80B,137C 'inject':6A,39B,70B,98C,127C 'let':7A 'lms':21B 'low':9A,56B,114C 'low-privileg':8A,55B,113C 'moodl':1A,22B,33B,88C,90C 'moodle-block':89C 'packag':23B 'paramet':51B,110C 'password':82B,139C 'permit':117C 'php':24B 'placehold':68B,125C 'prepar':44B,103C 'privileg':10A,57B,115C 'reach':46B 'read':12A,76B,133C 'report':3A,30B,42B,63B,85C,101C,120C 'request':109C 'select':74B,131C 'self':26B 'self-host':25B 'sql':5A,38B,43B,45B,97C,102C,104C 'subqueri':71B,128C 'tabl':14A,79B,136C 'union':73B,130C 'use':64B,121C 'user':11A,58B,81B,116C,138C 'var':50B,67B,108C,124C 'via':105C 'view':61B,119C 'viewreport.php':53B,112C 'vulner':99C","nicknames":[],"mitigations":[],"who_affected":"Moodle sites running the Configurable Reports block before 5.3.1 where reports use the %%FILTER_VAR%% placeholder and some users can view those reports. The exposure depends on that placeholder being in use and on users with low privileges having report view access. Sites without the block, or on 5.3.1 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113608","severity":null,"published_at":"2026-10-20T16:17:11+00:00","modified_at":"2026-10-21T16:17:23+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}