IcProgreso Innovación y Cualificación Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the IcProgreso Innovación y Cualificación plugin for Moodle. This vulnerability allows attackers to obtain, update, and delete data from the database by injecting SQL queries through specific parameters in the endpoint '/report/icprogreso/generar_blocks.php'.

Impact

Exploitation of this vulnerability allows for unauthorized database access, enabling attackers to manipulate data by injecting malicious SQL queries, potentially leading to data loss or corruption.

Remediation

A new version has been released that addresses the vulnerabilities in the affected plugins. This update has been implemented in all installations of the affected software, with the process expected to be completed by December 2024.