MRBS SQL Injection Vulnerability

vendor:

MRBS

by:

Not mentioned

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: MRBS

Affected Version From: Not mentioned

Affected Version To: Not mentioned

Patch Exists: NO

Related CWE: Not mentioned

CPE: Not mentioned

Metasploit:

Other Scripts:

Platforms Tested: Not mentioned

Not mentioned

MRBS SQL Injection Vulnerability

MRBS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Mitigation:

It is recommended to sanitize user-supplied input before using it in SQL queries to prevent SQL injection attacks. Additionally, keeping the software up-to-date with the latest security patches can help mitigate such vulnerabilities.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/26977/info

MRBS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue was previously documented as a vulnerability in Moodle. Further reports indicate this issue affects MRBS, and the MRBS module for Moodle. 

http://www.example.com/PATH/moodle/ing/blocks/mrbs/code/web/view_entry.php?id=2000%20UNION%20SELECT%20username,id,id,id,id,id,id,id,id,id,id,id%20FROM%20mdl_user%20WHERE%20id=[ID]&day=27&month=10&year=2007