CVE-2022-0332: Moodle SQL Injection Vulnerability

CVE-2022-0332 Overview

A SQL injection vulnerability was discovered in Moodle, the popular open-source learning management system. The flaw exists in versions 3.11 to 3.11.4 within the H5P activity web service responsible for fetching user attempt data. This vulnerability allows remote attackers to execute arbitrary SQL commands against the underlying database without authentication, potentially leading to complete database compromise, data exfiltration, and unauthorized access to sensitive educational records.

Critical Impact

Unauthenticated remote attackers can exploit this SQL injection vulnerability to extract sensitive data, modify database contents, or potentially achieve remote code execution on the underlying server.

Affected Products

• Moodle versions 3.11 to 3.11.4

Discovery Timeline

• 2022-01-25 - CVE-2022-0332 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0332

Vulnerability Analysis

This vulnerability (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) allows attackers to inject malicious SQL statements through the H5P activity web service. The H5P module in Moodle provides interactive content capabilities, and its web service endpoint for retrieving user attempt data fails to properly sanitize input parameters before incorporating them into database queries.

The vulnerability is particularly dangerous because it requires no authentication to exploit. An attacker can craft malicious requests to the vulnerable web service endpoint, injecting SQL payloads that bypass input validation and execute directly against the Moodle database. This could result in unauthorized access to student records, grades, personal information, and administrative credentials.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and parameterization within the H5P activity web service. User-supplied data used to fetch attempt information is directly concatenated into SQL queries rather than being properly escaped or handled through prepared statements with bound parameters.

Attack Vector

The attack vector is network-based, requiring no user interaction and no privileges. An attacker can send crafted HTTP requests to the vulnerable H5P web service endpoint, embedding SQL injection payloads within the parameters used to query user attempt data.

The exploitation process involves identifying the vulnerable web service endpoint, crafting malicious SQL payloads designed to extract or manipulate database contents, and sending these payloads through standard HTTP requests. Successful exploitation can lead to disclosure of sensitive information including user credentials, student data, and potentially administrative access to the entire Moodle installation. For detailed technical information, refer to the Moodle Security Advisory.

Detection Methods for CVE-2022-0332

Indicators of Compromise

• Unusual database query patterns or errors in Moodle logs, particularly related to the H5P module
• Unexpected access patterns to the H5P activity web service endpoints
• Database audit logs showing suspicious SELECT, UNION, or data extraction queries
• Abnormal response times or payload sizes from H5P-related API endpoints

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection patterns targeting Moodle endpoints
• Implement database activity monitoring to detect anomalous query patterns
• Review Moodle access logs for unusual requests to /lib/ajax/service.php or H5P-related services
• Deploy SentinelOne Singularity to detect post-exploitation activities and lateral movement

Monitoring Recommendations

• Enable detailed logging for the Moodle H5P module and web services
• Configure alerts for database errors indicating potential SQL injection attempts
• Implement network-level monitoring for suspicious traffic patterns to Moodle servers
• Review authentication logs for unauthorized access following potential exploitation

How to Mitigate CVE-2022-0332

Immediate Actions Required

• Upgrade Moodle to version 3.11.5 or later immediately
• Review database logs for evidence of exploitation
• Audit user accounts and privileges for unauthorized changes
• Consider temporarily disabling the H5P module if immediate patching is not possible

Patch Information

Moodle has released security patches addressing this vulnerability. Administrators should upgrade to Moodle 3.11.5 or later, which includes proper input sanitization for the H5P activity web service. The official security advisory is available at the Moodle Forum Discussion. Additional details can be found in the Red Hat Bug Report #2043661.

Workarounds

• Disable the H5P activity module if not required for educational operations
• Implement a web application firewall (WAF) with SQL injection detection rules
• Restrict network access to Moodle web services to trusted IP ranges
• Enable database query logging to detect exploitation attempts

# Disable H5P module temporarily via Moodle CLI
php admin/cli/uninstall_plugins.php --plugins=mod_h5pactivity --run

# Or restrict access via Apache configuration
<Location "/lib/ajax/service.php">
    Require ip 192.168.1.0/24
</Location>