CVE-2024-43436

What it actually does

Unsanitized user input in the XMLDB editor is concatenated directly into SQL queries, allowing an authenticated site administrator to execute arbitrary SQL statements against the database.

Why it matters to the business

An administrator could read, modify, or delete sensitive data stored in the Moodle database, potentially leading to data exposure or integrity loss for the entire learning platform.

How an attack unfolds

An attacker logs in with site administrator privileges, opens the XMLDB editor, and supplies a crafted payload that alters the generated SQL statement to perform unauthorized operations such as data exfiltration or privilege changes.

How to fix it

Upgrade Moodle to the commit aea9770cfc7d003a737f4899489d1e3982efe9ac or later; restrict XMLDB editor access to trusted administrators until the patch is applied.

How to confirm the fix worked

Confirm the installed codebase contains commit aea9770cfc7d003a737f4899489d1e3982efe9ac and test that previously exploitable inputs no longer alter query behavior.

Typical attack path

1. Obtain site administrator credentials
2. Navigate to the XMLDB editor interface
3. Submit malicious input containing SQL syntax
4. Trigger the vulnerable code path that builds and executes the query
5. Observe or extract results from the database response

How to detect it

Review web server and application logs for XMLDB editor requests containing SQL metacharacters, unusual query patterns, or sudden large data exports initiated by administrator accounts.

What your security team should do

• Apply the fixed commit immediately given administrator-level access to the editor
• Audit administrator accounts and reduce the number of users with XMLDB editor rights
• Enable database query logging for the XMLDB editor module to monitor for anomalous statements