CVE-2004-2232

Vulnerability

An SQL injection vulnerability exists in the sql.php file of the Glossary module in Moodle versions 1.4.1 and earlier [1]. The vulnerability arises because user-supplied input is not properly sanitized before being incorporated into SQL queries, allowing an attacker to inject arbitrary SQL commands [2].

Exploitation

A remote attacker can exploit this vulnerability by sending specially crafted HTTP requests to the sql.php script. No authentication is required, and the attacker can manipulate parameters to inject malicious SQL code [1][2].

Impact

Successful exploitation allows the attacker to modify SQL statements, potentially leading to unauthorized access to or modification of database contents, including user data and course information [1].

Mitigation

The vulnerability is fixed in Moodle 1.4.2 and later versions [2]. Users should upgrade to a patched release immediately. No workarounds are documented in the available references.