Description
Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string.
Remediation
References
Related Vulnerabilities
MediaWiki Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2021-36129)
IBM WebSEAL Other Vulnerability (CVE-2023-30998)
WordPress Plugin Backup Migration Cross-Site Request Forgery (1.2.9)
SharePoint CVE-2020-17015 Vulnerability (CVE-2020-17015)
Ruby on Rails Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-33658)