Moodle Block Configurablereports
Monthly
Authenticated users on Moodle instances running the Configurable Reports block before 5.3.0 can read restricted SQL reports containing user and grade data by supplying arbitrary report IDs to the block_configurable_reports_get_report_data web service. The CWE-863 authorization bypass occurs because a failed check_permissions call adds only a warning and still returns the full report table, so any valid logged-in account can access reports without the required permissions when Moodle web services are enabled. Exploitation requires a valid login but no elevated role, impact is read-only confidentiality loss, and no public exploit identified at time of analysis.
SQL injection in the Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 allows an authenticated low-privileged user to read arbitrary database tables - including Moodle user password hashes - through the filter_var request parameter of viewreport.php. Exploitation requires that the attacker hold the capability to view a SQL-type report that was authored with the %%FILTER_VAR%% placeholder, which is why the vector carries AT:P and PR:L; impact is limited to confidentiality (C:H with I:N/A:N) and no user interaction is needed. A vendor patch is available in release 5.3.1, and no public exploit code was identified at time of analysis.
Authenticated users on Moodle instances running the Configurable Reports block before 5.3.0 can read restricted SQL reports containing user and grade data by supplying arbitrary report IDs to the block_configurable_reports_get_report_data web service. The CWE-863 authorization bypass occurs because a failed check_permissions call adds only a warning and still returns the full report table, so any valid logged-in account can access reports without the required permissions when Moodle web services are enabled. Exploitation requires a valid login but no elevated role, impact is read-only confidentiality loss, and no public exploit identified at time of analysis.
SQL injection in the Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 allows an authenticated low-privileged user to read arbitrary database tables - including Moodle user password hashes - through the filter_var request parameter of viewreport.php. Exploitation requires that the attacker hold the capability to view a SQL-type report that was authored with the %%FILTER_VAR%% placeholder, which is why the vector carries AT:P and PR:L; impact is limited to confidentiality (C:H with I:N/A:N) and no user interaction is needed. A vendor patch is available in release 5.3.1, and no public exploit code was identified at time of analysis.