Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

BizDirectory all version xss

PhotoPost PHP  4.6 - 4.5 [PP_PATH] >> Remote File Include Vulnerability

MyBB 1.2 Full path and Cross site scripting vulnerabilities

Q-Shop v3.5(browse. asp) Remote SQL Injection Vulnerability

From:	Omid <omid_(at)_hackers.ir>
Date:	19.09.2006
Subject:	Sql injection in Moodle

Hi,
There is a sql injection in Moodle 1.6.1+ (and maybe
before versions) :

The "$blogEntry" parameter passed to "insert_record()"
function in /blog/edit.php, is not checked properly .

Version 1.6.2 has been released (moodle.org).


- Omid