CVE-2026-119554
Received Received - Intake

SQL Injection in Moodle via External Database Plugin

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119554
EUVD
EUVD-2026-113819

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in Moodle versions through 5.3.0, 5.2.4, 5.1.8, 5.0.11, and 4.5.15. It exists in the External database enrolment plugin where editing teachers can inject a backslash-quote payload into the course idnumber field. When the system synchronizes with MySQL/MariaDB external databases, the payload executes, allowing attackers to read sensitive data and manipulate enrolment results.

Detection Guidance

To detect this vulnerability, check if the Moodle External database enrolment plugin is enabled and review course idnumber fields for suspicious backslash-quote payloads. Inspect cron job logs for enrol_database plugin execution and look for SQL injection patterns in synchronization queries.

Impact Analysis

An attacker with editing teacher privileges could exploit this to read unauthorized data from external databases and alter enrolment records. This could lead to unauthorized access to courses, privilege escalation, or manipulation of user enrolments across the system. The impact includes data breaches and compromised course access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal data, violating GDPR and HIPAA requirements for data protection and access control. A successful exploit may result in data breaches, triggering compliance violations, legal penalties, and reputational damage for organizations handling protected health or personal information.

Mitigation Strategies

Immediately disable the enrol_database plugin if not in use. Update Moodle to the latest patched version. If using an affected version, apply parameterized queries to the enrol_database plugin as recommended in the auth_db patch. Review and sanitize all course idnumber fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart