Moodle Configurable Reports CVE-2026-113608

Requires an authenticated low-privileged Moodle user (PR:L) who has been granted permission to view a Configurable Reports SQL-type report whose query embeds the %%FILTER_VAR%% placeholder - this is the exact precondition reflected by AT:P in the CVSS 4.0 vector. The vulnerable path is report_sql::prepare_sql() reached via the filter_var request parameter of viewreport.php. Exploitation is LIMITED by: (1) authentication is mandatory; (2) a report must have been authored using %%FILTER_VAR%% and shared with the attacker, which is not the default state of a fresh install; and (3) versions before 5.3.1 only. No end-user interaction is needed (UI:N), and impact is confined to reading data (confidentiality), not modifying it.

This is a genuine but moderate-priority issue, best characterized as an authenticated confidentiality-disclosure flaw rather than a drive-by critical. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H) is internally consistent with the description: exploitation is network-reachable and low-complexity, but requires low privileges (PR:L - an authenticated Moodle account) and carries an attack requirement (AT:P) because a report using the %%FILTER_VAR%% placeholder must exist and be viewable by the attacker. Impact is confidentiality-only (VC:H, VI:N, VA:N), matching a read-oriented SQLi that can extract arbitrary tables including password hashes. No EPSS score, KEV listing, or public exploit was provided in the input, so there is no signal of active or widespread exploitation - the base score of 6.0 (Medium) is driven by the high confidentiality impact being gated behind privileges and a configuration precondition. The source-code diff from VulnCheck confirms the root cause and fix, which raises confidence that the vulnerability is real and well-understood, but absent POC/KEV/EPSS data this should be treated as a timely patch-soon item (credential-hash exposure is serious) rather than an emergency. One nuance to verify: the description says 'read arbitrary database tables,' which in Moodle means the entire shared application database - defenders should assume full-DB read, not just report-scoped data.

An attacker with a legitimate low-privilege Moodle account that is permitted to view a Configurable Reports SQL report containing the %%FILTER_VAR%% placeholder supplies a crafted filter_var parameter to viewreport.php. Because the left-hand side of the filter clause was interpolated into the SQL string, the attacker breaks out with a UNION SELECT or subquery to dump the mdl_user table and extract stored password hashes. No public exploit was identified at time of analysis, though the VulnCheck advisory and patch diff disclose the vulnerable regex and injection points in detail.