EUVD-2025-210998
GHSA-fhrw-qgv4-45hr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Moodle site with Socialwall v3.0-3.3
-
DeliverySend crafted HTTP request to plugin endpoint
-
ExploitInject SQL via unsanitized parameter
-
ExecutionRead/write backend database
-
ImpactExfiltrate credentials/session data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a Moodle installation running the third-party Socialwall course-format plugin at version 3.0 through 3.3; a non-vulnerable Moodle core or absence of this specific plugin removes exposure. Exploitation is via crafted HTTP request to the plugin's vulnerable parameter. The supplied vector claims no authentication (PR:N), but Moodle plugin endpoints commonly require a valid authenticated session, so a valid account may in practice be needed - this limiting factor is UNCONFIRMED from the available data and should be verified with the maintainer. No user interaction is required. |
| Impact | Signals conflict and the underlying metadata is thin. The MITRE-supplied CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reads as boilerplate 'critical' rather than a substantiated assessment: the description substantiates only SQL injection (CWE-89), yet claims 'execute arbitrary code' and carries an 'RCE' tag that is not supported by any evidence - SQLi against a Moodle plugin yields database read/write, not confirmed code execution. PR:N is also unconfirmed; Moodle plugin endpoints typically require an authenticated session, so a more defensible privilege metric is PR:L, lowering the realistic base score to the high-8 range and dropping availability impact. There is NO EPSS score, NO CISA KEV listing, and NO SSVC decision data provided, so exploitation probability and automatability cannot be quantified from the input. A public technical writeup exists (Medium, author lcrawfqrd) describing the SQLi, which raises practical exploitability, but a writeup is not the same as active exploitation. Net: this is a genuine SQL injection worth patching, but the 9.8/RCE framing overstates it - treat as a serious injection bug in a niche third-party plugin, not a top-tier internet-wide emergency. Verify authentication requirement and the RCE claim with the plugin maintainer before prioritizing as critical. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to a vulnerable Socialwall plugin endpoint on a Moodle site running plugin v3.0-v3.3, injecting SQL through an unsanitized parameter to read or modify database contents such as user credentials, session data, or configuration. A public technical writeup (Medium, lcrawfqrd) documents the injection, lowering the skill barrier, though no packaged/weaponized exploit is confirmed and the 'arbitrary code execution' outcome is not substantiated beyond database compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
SQL injection in the third-party Socialwall course-format plugin for Moodle (versions 3.0 through 3.3) lets remote attackers inject crafted SQL through a plugin HTTP endpoint, granting high confidentiality and integrity impact on the Moodle database. The vendor-supplied CVSS of 9.8 assumes no authentication, but our assessment lowers this to a PR:L vector (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.8) because plugin endpoints in Moodle typically require a valid authenticated session - a limiting factor that remains unconfirmed from available metadata. Exploitation is not confirmed actively exploited (no CISA KEV listing), and while a public Medium write-up describes the SQLi, no public exploit code has been confirmed at time of analysis; note that the CVE description's claim of arbitrary code execution is broader than the assessed confidentiality/integrity-only impact.
RemediationAI
No vendor-released patch was identified at time of analysis, so there is no confirmed fixed version to upgrade to; verify the Moodle plugins directory and the Socialwall maintainer's release channel for a release later than 3.3, and if one exists upgrade the plugin (and re-run the site upgrade) immediately. If no fixed build is available, the most reliable mitigation is to disable or uninstall the Socialwall course format at Site administration → Plugins → Plugins overview → Course formats, or remove the plugin's directory from moodle/mod/, which eliminates the vulnerable endpoint entirely at the cost of reverting affected courses to another format and losing Socialwall-specific layout features. Where removal is not feasible, restrict access to the plugin's endpoints (block or challenge requests to the Socialwall AJAX/web-service paths at the WAF or reverse proxy), enforce strict input filtering for the affected parameter, and audit the database user used by Moodle so it holds only the minimum privileges needed (no FILE, no broad DML on unrelated schemas) to blunt any SQLi escalation. Because exposure hinges on authenticated access in practice, also review web server logs for anomalous plugin requests and rotate Moodle credentials and salts if compromise is suspected; contact the plugin maintainer to confirm the authentication requirements and the true fix version, since the supplied PR:N vector conflicts with the assessed PR:L vector.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 improper neutralization of special elements in SQL commands (SQL injection) inside the Socialwall course-format plugin, an optional third-party extension installed on top of a Moodle site. Course-format plugins are invoked when rendering course pages and can expose AJAX/web-service endpoints that build SQL queries from request parameters; the Medium reference indicates the injection point is reachable through crafted HTTP requests to such a plugin endpoint. The supplied CPE string (cpe:2.3:a:n/a:n/a) is a placeholder and does not resolve a real vendor/product, so affected scope must be derived from the CVE/EUVD text (Socialwall 3.0-3.3) rather than from CPE matching; Moodle core is not affected and only sites with this specific plugin installed are exposed. SQL injection into a Moodle database is serious because stored credentials hashes, session data, and course content live there, and depending on database privileges it can be extended toward file read/write or command execution - but the independent assessment caps confirmed impact at high confidentiality and integrity with no availability effect, so code execution should be treated as a possible escalation, not a demonstrated outcome.
Know when Moodle gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network SQLi with low complexity; PR:L because Moodle plugin endpoints typically require an authenticated session; SQLi gives DB read/write (C:H/I:H) but no substantiated availability or RCE impact (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests
Executive ViewAI
Organizations running the third-party Socialwall course-format plugin for Moodle, versions 3.0 through 3.3, face a critical SQL injection exposure that could compromise the confidentiality and integrity of the Moodle database, putting course, user, and student data at risk. No vendor-released patch identified at time of analysis, and the plugin's third-party status makes remediation dependent on vendor action or removal, which should elevate this to a leadership-level supply-chain and data-protection issue. No public exploit identified at time of analysis, and the assessed attack is authenticated (PR:L), but the absence of a patch and the database-level impact warrant immediate containment.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or removing the Socialwall plugin versions 3.0 through 3.3 where feasible, restricting plugin endpoint access to trusted authenticated users, enforcing least privilege on the Moodle database, deploying WAF SQL injection virtual patching, and monitoring database and web logs for anomalous queries or data modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. Rated critical severi
A flaw was found in Moodle. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authenticatio
In Moodle 2.x and 3.x, SQL injection can occur via user preferences. Rated critical severity (CVSS 9.8), this vulnerabil
The Moodle LMS Jmol plugin version 6.1 and earlier contains a path traversal vulnerability in jsmol.php. The query param
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, an
Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remo
Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows re
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional re
An issue was discovered in Moodle 3.x. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low a
Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injectio
Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows
Exploit-DB