CVE-2021-36392
📋 TL;DR
CVE-2021-36392 is a critical SQL injection vulnerability in Moodle's user enrollment library that allows attackers to execute arbitrary SQL queries. This affects all Moodle instances with vulnerable versions, potentially compromising user data and system integrity. Attackers could access, modify, or delete database content through this flaw.
💻 Affected Systems
- Moodle
📦 What is this software?
Moodle by Moodle
Moodle by Moodle
Moodle by Moodle
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, manipulation, or deletion; potential privilege escalation to administrative access; possible remote code execution through database functions.
Likely Case
Unauthorized access to sensitive user information (grades, personal data, course materials); manipulation of enrollment records; potential access to other users' data.
If Mitigated
Limited impact with proper input validation and parameterized queries; database permissions limiting damage scope; web application firewalls blocking malicious SQL patterns.
🎯 Exploit Status
Exploitation requires authenticated access to Moodle. SQL injection vulnerabilities are well-understood and frequently weaponized. Public discussions include technical details that could facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Moodle 3.9.8, 3.10.5, 3.11.2
Vendor Advisory: https://moodle.org/mod/forum/discuss.php?d=424797
Restart Required: No
Instructions:
1. Backup your Moodle database and files. 2. Update to patched version via Moodle's admin interface or manual upgrade. 3. Verify the update completed successfully. 4. Test core functionality after patching.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation for user enrollment parameters
Not applicable - requires code modification
Web Application Firewall Rules
linuxDeploy WAF rules to detect and block SQL injection patterns
# Example ModSecurity rule: SecRule ARGS "(?i)(union|select|insert|update|delete|drop|--|#)" "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt'
🧯 If You Can't Patch
- Implement strict database user permissions limiting write/delete operations
- Enable detailed SQL query logging and monitor for suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check Moodle version via admin interface or config.php: $CFG->version value. Compare against affected versions.Check Version:
php -r "require_once('config.php'); echo 'Moodle version: ' . $CFG->version;"Verify Fix Applied:
Verify version is 3.9.8+, 3.10.5+, or 3.11.2+. Test enrollment functionality works normally without errors.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed enrollment attempts with malformed parameters
- Unexpected database errors in Moodle logs
Network Indicators:
- HTTP requests with SQL keywords in enrollment parameters
- Unusual database connection patterns from web server
SIEM Query:
source="moodle_logs" AND ("SQL error" OR "database error") AND "enrol"