CVE-2021-36568

An attacker who can create or edit a course adds a "Database" resource, then creates a "Text" field type within it. The attacker injects malicious JavaScript into the "Field name" or "Field description" input fields [ref_id=1]. When a victim accesses the course, clicks "Search" (the search interface for the database activity), the stored payload executes in the victim's browser [ref_id=1]. The vulnerability is classified as stored XSS [CWE-79] because the malicious script is persisted in the database and served to other users.

The advisory does not identify specific files or functions. The vulnerability resides in the Database activity module's handling of "Text" field types, specifically the "Field name" and "Field description" input fields [ref_id=1]. These fields are rendered without proper sanitization when a user accesses the search interface.

No patch is included in the bundle. The advisory does not specify whether Moodle released a fix for this issue. Based on the reference write-up [ref_id=1], the remediation would require proper output encoding or sanitization of the "Field name" and "Field description" values before they are rendered in the search page, preventing injected scripts from executing.