Unscored severity · published Jul 23, 2012
CVE-2012-3395
SQL injection vulnerability in mod/feedback/complete.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to execute…
–
CVSS
1.6%
EPSS
No
On KEV
Description
SQL injection vulnerability in mod/feedback/complete.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to execute arbitrary SQL commands via crafted form data.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Moodle · Moodle
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +15 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3395
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3395
git.moodle.org
http://git.moodle.org/gw?p=moodle.git&a=search&h=9d8d2ee6192e8b7ebb6713bd6215e06f94e2a9f7&st=commit&s=MDL-27675
openwall.com
http://openwall.com/lists/oss-security/2012/07/17/1
secunia.com
http://secunia.com/advisories/49890
www.securityfocus.com
http://www.securityfocus.com/bid/54481
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/76961
More from Moodle
10.0
CVE-2019-3809
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions
9.8
CVE-2025-67856
Moodle: moodle: privilege escalation via incomplete role checks in badge awarding
9.8
CVE-2025-26533
SQL injection risk in course search module list filter
9.8
CVE-2024-33999
moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php
9.8
CVE-2023-5550
Moodle: rce due to lfi risk in some misconfigured shared hosting environments