Vulnerability Details CVE-2006-4785
SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insert_record function, which calls _adodb_column_sql in the adodb layer (lib/adodb/adodb-lib.inc.php), which does not convert the data type to an int.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.019
EPSS Ranking 82.5%
CVSS Severity
CVSS v2 Score 7.5
Products affected by CVE-2006-4785
-
cpe:2.3:a:moodle:moodle:-
-
cpe:2.3:a:moodle:moodle:1.1.1
-
cpe:2.3:a:moodle:moodle:1.2
-
cpe:2.3:a:moodle:moodle:1.2.0
-
cpe:2.3:a:moodle:moodle:1.2.1
-
cpe:2.3:a:moodle:moodle:1.3
-
cpe:2.3:a:moodle:moodle:1.3.0
-
cpe:2.3:a:moodle:moodle:1.3.1
-
cpe:2.3:a:moodle:moodle:1.3.2
-
cpe:2.3:a:moodle:moodle:1.3.3
-
cpe:2.3:a:moodle:moodle:1.3.4
-
cpe:2.3:a:moodle:moodle:1.3.5
-
cpe:2.3:a:moodle:moodle:1.4.0
-
cpe:2.3:a:moodle:moodle:1.4.1
-
cpe:2.3:a:moodle:moodle:1.4.2
-
cpe:2.3:a:moodle:moodle:1.4.3
-
cpe:2.3:a:moodle:moodle:1.4.4
-
cpe:2.3:a:moodle:moodle:1.4.5
-
cpe:2.3:a:moodle:moodle:1.5
-
cpe:2.3:a:moodle:moodle:1.5.0
-
cpe:2.3:a:moodle:moodle:1.5.1
-
cpe:2.3:a:moodle:moodle:1.5.2
-
cpe:2.3:a:moodle:moodle:1.5.3
-
cpe:2.3:a:moodle:moodle:1.5.4
-
cpe:2.3:a:moodle:moodle:1.6
-
cpe:2.3:a:moodle:moodle:1.6.0
-
cpe:2.3:a:moodle:moodle:1.6.1