CVE-2026-102578: Moodle Question Bank SQL Injection Flaw

CVE-2026-102578 Overview

A SQL injection vulnerability affects Moodle's question bank web service. Authenticated attackers with access to the service can submit unsanitized input that flows directly into database queries. The flaw is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Successful exploitation allows attackers to view, alter, or delete sensitive data stored in the underlying database. The vulnerability requires high privileges to exploit but can be triggered over the network without user interaction.

Critical Impact

Authenticated attackers can read, modify, or delete database records through the Moodle question bank web service, exposing user records, course content, and assessment data.

Affected Products

• Moodle Learning Management System (question bank web service component)
• Red Hat distributions packaging affected Moodle versions
• Refer to the Red Hat CVE-2026-102578 Advisory for specific package versions

Discovery Timeline

• 2026-09-30 - CVE CVE-2026-102578 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102578

Vulnerability Analysis

The vulnerability resides in Moodle's question bank web service endpoint. The service accepts parameters from authenticated users and passes them into database queries without proper sanitization or parameterization. An attacker with valid credentials and access to the question bank service can craft input that alters the intended query structure.

Moodle typically abstracts database access through its $DB layer, which supports parameter binding. When a code path bypasses that abstraction or concatenates user input into a query fragment, the query becomes injectable. The upstream fix is tracked as MDL-89383 in the Moodle source repository.

Exploitation yields high confidentiality impact and limited integrity impact against the database. Availability is not directly affected by the flaw itself.

Root Cause

The root cause is improper neutralization of special characters in SQL statements [CWE-89]. Input received through the question bank web service is embedded into query text without being parameterized or escaped. This allows an attacker to break out of the intended data context and inject arbitrary SQL clauses.

Attack Vector

The attack vector is network-based. The attacker must first authenticate to Moodle and hold a role that grants access to the question bank web service, such as a teacher or manager account. Once authenticated, the attacker submits crafted parameters to the vulnerable service endpoint. No user interaction is required beyond the attacker's own request.

See the Moodle Commit MDL-89383 and the Moodle Forum Discussion #482496 for upstream technical details.

Detection Methods for CVE-2026-102578

Indicators of Compromise

• Web server access logs containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in question bank web service parameters
• Unusual database queries originating from Moodle PHP processes that reference system tables or information schema
• Unexpected read or modification activity against mdl_user, mdl_question, or related tables by low-privileged authenticated sessions

Detection Strategies

• Enable Moodle debug logging and database query logging on staging environments to identify anomalous query patterns from the question bank component
• Deploy a web application firewall rule set that inspects question bank endpoint parameters for SQL injection payload signatures
• Correlate authenticated user session activity with database error responses that may indicate probing attempts

Monitoring Recommendations

• Alert on repeated HTTP 500 responses from question bank web service URLs, which can indicate failed injection attempts
• Monitor authenticated Moodle accounts for atypical web service call volume or off-hours activity
• Track database user permissions to ensure the Moodle service account has least-privilege access, limiting the blast radius of injection

How to Mitigate CVE-2026-102578

Immediate Actions Required

• Apply the upstream Moodle patch that resolves MDL-89383 as soon as a fixed release is available for your branch
• Audit accounts with access to the question bank web service and revoke privileges from users who do not require them
• Rotate web service tokens issued to accounts with question bank access after patching

Patch Information

The fix is committed upstream under Moodle issue MDL-89383. Reference the Moodle Commit MDL-89383 and the Red Hat CVE-2026-102578 Advisory for packaged updates. Red Hat tracking is available in Red Hat Bugzilla #2543632.

Workarounds

• Restrict the webservice/rest/server.php and related endpoints to a limited set of trusted IP addresses using upstream network controls
• Disable the question bank web service functions in Moodle site administration until the patch is applied
• Enforce database-level least privilege so the Moodle application account cannot alter schema or access unrelated databases

# Configuration example: disable question bank web service functions
# Site administration > Server > Web services > External services
# Remove or disable functions matching core_question_* until patched
#
# Optional: restrict web service endpoint at the web server layer (nginx)
location ~ ^/webservice/ {
    allow 10.0.0.0/8;
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}