CVE-2026-102578

Executive Summary

CVE-2026-102578 is a SQL injection vulnerability (CWE-89) in Moodle, the widely deployed open-source Learning Management System. An authenticated attacker who holds access to the question bank web service can submit unsanitized input that is passed directly into database queries, enabling manipulation of the underlying database. Successful exploitation allows reading, altering, or deleting sensitive data, with the highest impact on confidentiality (CVSS 5.5, C:H/I:L/A:N). No public proof-of-concept, exploit code, or vendor patch is currently available.

Technical Analysis

The vulnerability resides in the Moodle question bank web service functionality. According to the NVD description, the root cause is that "unsanitized input" supplied by an authenticated user with question bank web service access is incorporated "directly into database queries." This is the canonical pattern for CWE-89 (Improper Neutralization of Special Elements used in an SQL Command, i.e., SQL Injection). The flaw class indicates that user-controllable data reaches a SQL query without adequate parameterization or escaping, allowing the attacker to break out of the intended query structure and inject additional SQL syntax.

Key characteristics derivable from the supplied data:

• Attack surface: The Moodle web service layer, specifically the question bank subsystem. Moodle exposes web services (typically over REST/SOAP) that authenticate via tokens; the affected interface is reachable by any principal granted access to the question bank web service.
• Authentication requirement: The CVSS vector specifies PR:H (Privileges Required: High). This means the attacker must already be an authenticated, privileged user — not an anonymous internet user. The barrier to entry is therefore elevated relative to an unauthenticated injection, but insiders, compromised accounts, and low-trust authenticated roles with the relevant web service capability are all in scope.
• Attack complexity: AC:L (Low) and UI:N (None) — no specialized conditions, no user interaction. An attacker with the required access can exploit deterministically.
• Scope: S:U (Unchanged) — the vulnerable component and impacted component are the same security authority (the Moodle application and its database).
• Confidentiality impact: C:H (High). The description explicitly states the attacker "could allow an attacker to view, alter, or delete sensitive data stored in the underlying database." Full read of the database via the injection channel is plausible, including user records, password hashes, course content, grades, and other institutional data.
• Integrity impact: I:L (Low). The description allows for alteration and deletion of data, but the CVSS subscore of Low reflects constrained write capability relative to full lateral control — consistent with an injection channel where reads are straightforward and writes are possible but the practical blast radius is bounded by the query context.
• Availability impact: A:N (None). No denial-of-service vector is described; the flaw is a data-exposure and data-tampering issue, not an availability issue.

No version range, specific endpoint, function name, parameter name, or code path is disclosed in the available data. The CNA title is empty, affected versions list is empty, and no OSV package mapping is provided. Any reference to specific Moodle functions, controllers, database tables, or API endpoints beyond "question bank web service" would be speculation and is deliberately omitted.

Exploitation Scenarios

Note: No public PoC or exploit code exists for CVE-2026-102578. The chain below is inferred strictly from the vulnerability class (CWE-89) and the NVD description. No specific function names, parameters, or paths are fabricated — where the data is silent, the scenario stays at the vulnerability-class level.

1. Reconnaissance / target identification. The attacker identifies a Moodle instance exposing its web service interface (commonly over HTTPS at the standard web services endpoint). Fingerprinting via Shodan dorks (e.g., http.title:"Moodle", http.html:"/login/index.php") and directory probing for the web service entry points reveals candidate targets. The attacker must obtain valid credentials for a role that has been granted access to the question bank web service. This could be a legitimate enrollment, a compromised low-privilege account, or an insider misuse of granted privileges. Enumeration of the site's enabled web services and available functions (where the site exposes service discovery) further narrows the question-bank-related callable functions.

2. Triggering the flaw (SQL injection via question bank web service). Once authenticated and holding the required capability, the attacker invokes the question bank web service function and, in the parameters it accepts, supplies crafted SQL metacharacters instead of expected data values. Because the application concatenates this input directly into a database query without sanitization, the injected syntax is interpreted by the database engine rather than treated as data. The specific function, parameter, and query are not disclosed in the available intelligence, so the exact injection point cannot be named responsibly.

3. Payload / execution (vulnerability-class level). Classic SQLi technique applies: the attacker manipulates boolean or UNION-style conditions, error-based probes, or stacked/sub-SELECT statements depending on the database backend Moodle is configured against (Moodle supports multiple SQL backends). The injected input can:

   • Append conditions that always evaluate true (authentication/authorization bypass within the query context),
   • Use UNION SELECT-style constructs to return data from tables not intended to be exposed, or
   • Use subquery/stacked statements to read arbitrary rows.

   No time-based, error-based, or output-based payload specifics are asserted because the backend and query construction are not disclosed. The vulnerability class supports any of these techniques; the effective one depends on the deployment.

4. Post-exploitation impact. With a working injection channel, the attacker can read sensitive database content (C:H), including Moodle user records, credentials, course and grading data, and other institutional information. Per the description, the attacker can also "alter, or delete" data (I:L) — corrupting or removing records within the reach of the query. Because Scope is Unchanged (S:U), the attacker remains within the same security authority as the vulnerable component; however, an elevated-privilege authenticated user with database read access may be able to escalate further by harvesting credentials or session data that supports lateral movement within the LMS. Availability is unaffected (A:N).

Impact Assessment

• Confidentiality (High): The description states data can be viewed. For an LMS, this potentially includes personally identifiable information (students, staff), authentication material, assessment content, and institutional records — triggering GDPR/FERPA or equivalent notification obligations depending on jurisdiction and data content.
• Integrity (Low): Data can be altered or deleted. Even low-ranked integrity impact on authoritative academic records (grades, enrollment, assessment results) is operationally significant and may require restoration from backup.
• Availability (None): No availability impact is scored or described.
• CVSS subscores summary: AV:N (network-reachable), AC:L (no special conditions), PR:H (authenticated privileged user required), UI:N (no user interaction), S:U (unchanged scope), C:H/I:L/A:N. Base score 5.5 — Medium severity.
• Blast radius: Bounded by the privileges required (PR:H). The attack is not anonymous; it demands an authenticated account with question bank web service access. The effective blast radius therefore includes compromised privileged accounts, malicious insiders, and any scenario where a low-trust authenticated role is over-provisioned with the question bank web service capability. Multi-tenant or shared Moodle deployments enlarge the dataset exposed per instance.
• Business context: Educational institutions, enterprises using Moodle for training, and hosting providers are all in scope. Because the flaw sits behind authentication, initial access to some Moodle account is a prerequisite — but such accounts are commonly available to students and staff, elevating real-world risk if the question bank capability is broadly assigned.

Detection Guidance

Sigma Rule

title: Potential SQL Injection via Moodle Question Bank Web Service
id: 7c1f9a2e-3b4d-4e5f-9a6b-2d8c0e1f4a77
status: experimental
description: Detects SQL metacharacter patterns in web service requests targeting the Moodle question bank, indicative of CVE-2026-102578 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102578
author: Security Team
date: 2026-01-01
logsource:
  category: webserver
  product: moodle
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-query|contains:
      - '/webservice/'
      - 'question'
  selection_payload:
    cs-uri-query|contains:
      - "' OR "
      - "' UNION "
      - 'UNION SELECT'
      - 'SELECT '
      - 'SLEEP('
      - 'BENCHMARK('
      - '--'
      - 'information_schema'
      - 'xp_cmdshell'
  condition: selection_method and selection_uri and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate question text containing SQL keywords or apostrophes
level: medium

YARA Rule

rule CVE_2026_102578_Moodle_SQLi
{
    meta:
        author = "Security Team"
        description = "Detects SQL injection payload patterns consistent with CVE-2026-102578 in Moodle question bank web service requests"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102578"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ws1 = "/webservice/" ascii nocase
        $ws2 = "question" ascii nocase
        $sqli1 = "UNION SELECT" ascii nocase
        $sqli2 = "' OR '" ascii nocase
        $sqli3 = "' OR 1=1" ascii nocase
        $sqli4 = "information_schema" ascii nocase
        $sqli5 = "SLEEP(" ascii nocase
        $sqli6 = "BENCHMARK(" ascii nocase
        $sqli7 = "LOAD_FILE(" ascii nocase
        $sqli8 = "--" ascii

    condition:
        filesize < 2MB and
        ($ws1 or $ws2) and
        any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102578 Possible SQL Injection in Moodle Question Bank Web Service"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/webservice/"; http.uri; content:"question"; http.request_body; content:"UNION"; nocase; http.request_body; content:"SELECT"; nocase; distance:0; sid:2026102578; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-102578, confidence Medium; classtype:web-application-attack;)
alert http any any -> any any (msg:"CVE-2026-102578 SQLi Metacharacter Pattern in Moodle Web Service"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/webservice/"; http.request_body; content:"' OR "; nocase; http.request_body; content:"1=1"; nocase; distance:0; sid:2026102579; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-102578, confidence Medium; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and
     http.request.method == "POST" and
     stringContains(http.request.uri, "/webservice/") and
     stringContains(http.request.uri, "question")]
  [network where network.protocol == "http" and
     stringContains(http.request.body, "UNION SELECT") or
     stringContains(http.request.body, "' OR ") or
     stringContains(http.request.body, "information_schema") or
     stringContains(http.request.body, "SLEEP(")]

Splunk SPL Query

index=web sourcetype=moodle:access OR sourcetype=apache:access
| eval uri=coalesce(uri, cs_uri_query, request)
| eval body=coalesce(request_body, cs_request_body, form_data)
| where match(uri, "(?i)/webservice/") OR match(body, "(?i)question")
| where match(body, "(?i)(UNION\s+SELECT|'\s*OR\s+'.*=|information_schema|SLEEP\(|BENCHMARK\(|LOAD_FILE\(|xp_cmdshell)")
| stats count values(body) as payloads by src_ip, uri, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="moodle,web,sqli,">
  <rule id="1025781" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/webservice/</field>
    <field name="url">question</field>
    <regex type="pcre2">(?i)(UNION\s+SELECT|'\s*OR\s+'|information_schema|SLEEP\(|BENCHMARK\(|LOAD_FILE\()</regex>
    <description>CVE-2026-102578: Possible SQL injection in Moodle question bank web service from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102578,sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor fix is listed, no affected version range is published, and no workaround is documented. The guidance below is class-based hardening and must not be represented as a vendor fix for this specific CVE.

1) Immediate mitigations

• Restrict the question bank web service capability. Audit every Moodle role and service token that is granted access to the question bank web service. Revoke the capability from any role that does not strictly require it. This directly attacks the PR:H precondition and shrinks the population of accounts capable of triggering the flaw.
• Rotate web service tokens for all principals that had question bank web service access, treating any such token as potentially abused until the flaw is remediated.
• Enforce least privilege on service accounts. Ensure no integration or service account combines question bank web service access with broader administrative capabilities.
• Apply network controls. Restrict access to Moodle web service endpoints to known integration sources (IP allow-listing, mTLS where supported) so that even an authenticated account cannot reach the vulnerable interface from arbitrary networks.
• Maintain current, isolated, tested backups of the Moodle database to support recovery from any integrity impact (data alteration/deletion) if exploitation occurs.
• Monitor for anomalous database and web service activity using the detection rules above; watch for unusual function invocation patterns from accounts that have not historically used question bank services.

2) Patch / upgrade steps

• No patch is available at the time of writing. Monitor the official Moodle security advisories and the Moodle security announcement channels for a fixed release addressing CVE-2026-102578.
• When a patched version is published, validate against a staging copy of the instance first, then upgrade production. Preserve the affected minor/branch line unless a supported upgrade path dictates otherwise.
• After upgrade, re-test the question bank web service interface to confirm the injection point is neutralized, and re-enable any capabilities/tokens that were suspended as an interim mitigation.

3) Long-term hardening

• Centralize and enforce parameterized queries. Ensure all database access — including web service handlers and question-bank-related code paths — uses prepared statements / parameter binding rather than string concatenation of user input. Treat any direct concatenation of request data into SQL as a defect to remediate even outside this CVE.
• Regular security patching cadence. Track Moodle security releases and apply them promptly; LMS deployments are frequently delayed on upgrades, widening exposure windows.
• Comprehensive logging and SIEM coverage for web service endpoints, database query anomalies, and privileged account activity, with alerting wired to the detections above.
• Periodic access reviews of web service tokens, roles, and capabilities to prevent privilege accumulation that raises the plausibility (and impact) of this class of flaw.
• Static and dynamic application security testing integrated into any custom Moodle plugin/theme development, since added code frequently bypasses upstream safe data-access patterns.

References

1. NVD — CVE-2026-102578: https://nvd.nist.gov/vuln/detail/CVE-2026-102578
2. CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): https://cwe.mitre.org/data/definitions/89.html
3. Moodle Security Announcements (vendor advisories): https://moodle.org/security/
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (status check — currently NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No public exploit, proof-of-concept, or Nuclei template exists for CVE-2026-102578, and it is not listed in CISA KEV. There is no evidence of active exploitation or attribution to a named threat actor in the available intelligence. The vulnerable component is behind authentication (PR:H), which limits opportunistic mass exploitation; however, Moodle is a high-value target for credential-harvesting and data-theft campaigns, and the confidentiality impact (C:H) makes this candidate attractive once an authenticated foothold is obtained. EPSS has not yet been scored by FIRST.org for this CVE; no EPSS value is asserted.