Read the docs
TI-2026-76937 Aliases CVE-2026-113608GHSA-7qwj-4vq5-8c2j

SQL injection in Configurable Reports block for Moodle lets users read data

Priority LOW 27CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an SQL injection flaw (CWE-89) in report_sql::prepare_sql() via the filter_var parameter of viewreport.php. Low-privileged users permitted to view reports that use the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT statements to read arbitrary database tables, including user password hashes.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00391 33rd percentileScored 2026-11-07
Fix Fixed moodle-block_configurablereports (jleyva): 5.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jleyvamoodle-block_configurablereportsbefore 5.3.15.3.1Patch availableCNA
  • moodle-block_configurablereports Vendorjleyva Affected before 5.3.1 Fixed in 5.3.1 Patch available CNA

Remediation

Update moodle-block_configurablereports to version 5.3.1 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA moodle-block_configurablereports (jleyva) Fixed in 5.3.1

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113608
  2. 2026-10-21 Alias added: GHSA-7qwj-4vq5-8c2j
  3. 2026-10-21 CISA SSVC decision points changed
  4. 2026-10-21 Priority changed: MEDIUM → LOW

References

Patch 2

Other 3

  • TI-2026-76936 Incorrect authorization in Moodle Configurable Reports block exposes reports CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences