Description
SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insert_record function, which calls _adodb_column_sql in the adodb layer (lib/adodb/adodb-lib.inc.php), which does not convert the data type to an int.
Remediation
References
Related Vulnerabilities
Zikula Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2011-0535)
Moodle Improper Following of Specification by Caller Vulnerability (CVE-2019-14829)
WordPress Cryptographic Issues Vulnerability (CVE-2013-2173)
WordPress Plugin Advanced Booking Calendar Cross-Site Scripting (1.6.7)
Apache Tomcat Improper Input Validation Vulnerability (CVE-2016-3092)