{"id":"CVE-2026-119554","kind":"vulnerability","aliases":["CVE-2026-119554"],"related":[],"title":"Moodle: SQL injection in external database enrolment via course ID number","description":"Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.","summary":"Editing teachers can store a crafted course idnumber that Moodle's External database enrolment plugin runs as SQL during scheduled sync. On MySQL or MariaDB external databases, an attacker can read data and change enrolment results.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lms","mariadb","moodle","mysql","runtime","self-hosted"],"not_affected_if":["non-mysql-database","plugin-disabled"],"how_to_check":"- Check the Moodle version under Site administration > Notifications and compare it to the affected ranges.\n- Confirm whether the External database enrolment plugin is enabled under Site administration > Plugins > Enrolments.\n- Confirm whether the external database connection uses MySQL or MariaDB.","fix":"- Moodle 5.3.0 and later branches are listed as affected; the sources do not state a fixed version.\n- Moodle 5.2.x, 5.1.x, 5.0.x and 4.5.x: the sources list affected ranges but do not state the fixed version.","status":"open","published_at":"2026-10-30T12:16:42+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","triaged_at":"2026-10-30T12:32:51+00:00","updated_at":"2026-10-30T12:32:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T12:32:51Z","model":"claude-haiku-5-5","output":{"fix":"- Moodle 5.3.0 and later branches are listed as affected; the sources do not state a fixed version.\n- Moodle 5.2.x, 5.1.x, 5.0.x and 4.5.x: the sources list affected ranges but do not state the fixed version.","reach":"internet","title":"Moodle: SQL injection in external database enrolment via course ID number","impact":"medium","summary":"Editing teachers can store a crafted course idnumber that Moodle's External database enrolment plugin runs as SQL during scheduled sync. On MySQL or MariaDB external databases, an attacker can read data and change enrolment results.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["moodle","lms","mysql","mariadb","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads database data and alters enrolment results.","analyst_note":"Find the fixed Moodle versions for each affected branch in the NVD entry or Moodle security announcements.","how_to_check":"- Check the Moodle version under Site administration > Notifications and compare it to the affected ranges.\n- Confirm whether the External database enrolment plugin is enabled under Site administration > Plugins > Enrolments.\n- Confirm whether the external database connection uses MySQL or MariaDB.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-disabled","non-mysql-database"],"who_is_affected":"Only sites running Moodle with the External database enrolment plugin enabled and an external MySQL or MariaDB database for enrolment. Editing teachers can trigger the injection, so the risk depends on who can edit course settings. Sites without that plugin or using other databases can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4215,"output_tokens":650,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119554':14A,17A '-2026':13A,16A '4.5.15':75C '5.0.0':70C '5.0.11':72C '5.1.0':67C '5.1.8':69C '5.2.0':64C '5.2.4':66C '5.3.0':63C 'attack':54B 'backslash':96C 'backslash-quot':95C 'chang':59B 'contain':76C 'cours':9A,32B,88C 'craft':31B 'cve':12A,15A 'data':57B,111C 'databas':6A,38B,52B,84C,109C 'edit':26B,90C 'enrol':7A,39B,60B,85C,114C 'execut':102C 'extern':5A,37B,51B,83C,108C 'host':25B 'id':10A 'idnumb':33B,89C,100C 'inject':3A,79C 'lms':18B 'manipul':113C 'mariadb':19B,50B 'moodl':1A,20B,35B,62C 'mysql':21B,48B 'mysql/mariadb':107C 'number':11A 'payload':98C 'plugin':40B,86C 'quot':97C 'read':56B,110C 'result':61B,115C 'run':41B 'runtim':22B 'schedul':45B,104C 'self':24B 'self-host':23B 'sql':2A,43B,78C 'store':29B,93C 'sync':46B,105C 'teacher':27B,91C 'via':8A,87C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Only sites running Moodle with the External database enrolment plugin enabled and an external MySQL or MariaDB database for enrolment. Editing teachers can trigger the injection, so the risk depends on who can edit course settings. Sites without that plugin or using other databases can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119554","severity":null,"published_at":"2026-10-30T12:16:42+00:00","modified_at":"2026-10-30T12:16:42+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","fetched_at":"2026-10-30T12:30:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}