Moodle Innovación y Cualificación Local Administration Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Innovación y Cualificación local administration plugin, specifically in the ajax.php file. This vulnerability allows attackers to obtain, update, and delete data from the database by injecting SQL queries through various parameters in the ajax.php endpoint.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to manipulate database queries. This could lead to unauthorized data access, data modification, or deletion.

Remediation

A new version has been released that addresses the vulnerabilities in the affected plugins. This update has been implemented in all installations of the affected software, with the process expected to be completed by December 2024.