CVE-2026-113608: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in jleyva moodle-block_configurablereports
Description
CVE-2026-113608 is an SQL injection vulnerability in the Configurable Reports block for Moodle (moodle-block_configurablereports) versions before 5.3.1. The flaw exists in the report_sql::prepare_sql() function via the filter_var request parameter in viewreport.php. Low-privileged users who can view reports using the %%FILTER_VAR%% placeholder may exploit this to inject subqueries or UNION SELECT statements, potentially reading arbitrary database tables including user password hashes.
CVSS v4.0
Score 6.0medium
Affected software
jleyva
moodle-block_configurablereports
pkg:github/moodle-block_configurablereportsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in moodle-block_configurablereports prior to version 5.3.1 allows SQL injection through the filter_var parameter in viewreport.php. This occurs in the report_sql::prepare_sql() function, where improper neutralization of special elements in SQL commands enables attackers with low privileges to inject SQL code. Exploitation can lead to unauthorized reading of database tables, including sensitive data such as user password hashes.
Potential Impact
An attacker with low privileges who can view reports using the %%FILTER_VAR%% placeholder can exploit this vulnerability to perform SQL injection. This allows reading of arbitrary database tables, including sensitive information like user password hashes, potentially compromising user credentials and database confidentiality.
Mitigation Recommendations
A fix is available in moodle-block_configurablereports version 5.3.1. Users should upgrade to version 5.3.1 or later to remediate this vulnerability. No vendor advisory was provided, so check the official project resources for the patch and update instructions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-20T11:48:58.973Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad78d892cdf04f6563d7704
Added to database: 10/20/2026, 15:49:29 UTC
Last enriched: 10/20/2026, 16:04:16 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.