CVE-2023-28329: SQL injection through the Moodle profile availability condition
The "User profile" access restriction inserted the name of the profile field it checks into its SQL query without validating it. Anyone allowed to set access restrictions in a course could rewrite that query.
1Summary
- Advisory
- MSA-23-0004
- System
- Moodle
- Component
- User profile availability condition (availability_profile)
- Class
- SQL injection
- Severity
- Serious
An access restriction lets a teacher show an activity only to, say, people from one department. Moodle stores which profile field to compare and the value to compare it with.
When evaluating the restriction, Moodle wrote that field name straight into the query on the user table without matching it against the existing profile fields. A freely chosen name therefore changed the SQL statement itself.
Reported by Vincent Schneider through the Moodle security process, published as MSA-23-0004.
2Who is affected
Editing teachers and managers, the people who can set access restrictions in a course.
In the default configuration only teachers and managers edit access restrictions.
The condition is part of Moodle core and present in every standard installation, so a site did not need any extra plugin to be affected.
3Impact
The altered statement runs under Moodle's database account. Through it a teacher can read tables the teacher interface never shows, such as other accounts' profile data or content from courses they are not enrolled in.
4Fix
- Affected versions
- 4.1.0 to 4.1.1, 4.0.0 to 4.0.6, 3.11.0 to 3.11.12, 3.9.19 and earlier
- Fixed in
- 4.1.2, 4.0.7, 3.11.13, 3.9.20
- Published
- 20 Mar 2023
- Fix in the source
- 81e74af
Since the fix, Moodle checks the field name against get_standard_profile_fields(). If the name is not on that list, nobody meets the condition and the name never reaches the query.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.