CVE-2022-0332: Moodle SQL Injection Vulnerability

CVE-2022-0332 Overview

CVE-2022-0332 is a SQL injection vulnerability affecting Moodle versions 3.11 through 3.11.4. The flaw resides in the H5P activity web service responsible for fetching user attempt data. An unauthenticated attacker can inject crafted SQL through the vulnerable service, manipulating database queries against the Moodle backend.

The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Moodle is a widely deployed open-source learning management system used by universities, schools, and enterprises, making this flaw relevant to organizations operating online education infrastructure.

Critical Impact

A remote attacker can execute arbitrary SQL queries against the Moodle database, potentially exposing user credentials, grades, and personal data, or altering academic records.

Affected Products

• Moodle 3.11
• Moodle 3.11.1 through 3.11.3
• Moodle 3.11.4

Discovery Timeline

• 2022-01-25 - CVE-2022-0332 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0332

Vulnerability Analysis

The vulnerability exists in the H5P activity component of Moodle. H5P is an interactive content framework integrated into Moodle for quizzes, presentations, and learning materials. The web service that retrieves user attempt data fails to properly sanitize input parameters before incorporating them into SQL queries.

An attacker submits crafted parameters to the affected H5P web service endpoint. The Moodle backend concatenates the attacker-controlled input into a SQL statement without adequate parameterization or escaping. The database server then executes the injected SQL fragments alongside the intended query.

Successful exploitation grants the attacker read and potentially write access to arbitrary tables in the Moodle database. This includes the mdl_user table holding password hashes, session tokens, and personally identifiable information.

Root Cause

The root cause is improper neutralization of special elements in SQL commands within the H5P attempt-fetching service. Input parameters used to construct database queries bypass Moodle's standard data manipulation layer safeguards. Developers introduced raw query concatenation rather than using the framework's parameterized query API.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends HTTP requests carrying malicious SQL payloads to the Moodle H5P web service endpoint. The vulnerability description does not enumerate the specific parameter or endpoint path, and no public proof-of-concept code is referenced in the advisory.

For technical specifics, refer to the Red Hat Bug Report #2043661 and the Moodle Forum Discussion #431099.

Detection Methods for CVE-2022-0332

Indicators of Compromise

• Unexpected HTTP requests to H5P activity web service endpoints containing SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences (--, /*).
• Database error messages in Moodle logs referencing malformed queries originating from H5P attempt requests.
• Anomalous read activity against mdl_user, mdl_user_password_history, or mdl_sessions tables from web application sessions.

Detection Strategies

• Inspect Moodle web server access logs for requests to /mod/h5pactivity/ paths containing encoded SQL syntax or unusually long query strings.
• Deploy a web application firewall ruleset that flags SQL injection patterns targeting Moodle endpoints.
• Correlate database slow-query logs with web requests to identify suspect injection attempts producing large result sets.

Monitoring Recommendations

• Enable Moodle debug logging at the database query level in non-production environments to baseline normal H5P traffic.
• Forward web, application, and database logs to a centralized analytics platform for cross-source correlation.
• Alert on authentication anomalies following suspected injection activity, including new admin accounts or password resets.

How to Mitigate CVE-2022-0332

Immediate Actions Required

• Upgrade Moodle to version 3.11.5 or later, which contains the official fix from the Moodle security team.
• Audit Moodle administrator and teacher accounts for unauthorized changes or new privileged users.
• Rotate database credentials and force password resets for all Moodle users if exploitation is suspected.

Patch Information

Moodle addressed the vulnerability in releases following 3.11.4. Administrators should consult the Moodle Forum Discussion #431099 for upgrade guidance and apply the security release through standard Moodle upgrade procedures.

Workarounds

• Restrict access to the H5P activity module by disabling it under Site administration until patching is complete.
• Place Moodle behind a web application firewall configured with SQL injection signatures.
• Limit database account privileges so the Moodle application user cannot access tables outside its required scope.

# Configuration example: disable H5P activity module pending patch
php admin/cli/uninstall_plugins.php --plugins=mod_h5pactivity --run
# Verify Moodle version after upgrade
php admin/cli/cfg.php --name=release