CVE-2025-46337

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. Moodle bundles ADOdb, a PHP database abstraction library, in lib/adodb. Moodle's own database layer does not use it for its main database, but plugins such as external database authentication and enrolment, and third-party code, use it to connect to other databases.

A SQL Injection vulnerability (CVE-2025-46337) has been identified in the PostgreSQL driver of the ADOdb library bundled with Moodle and IOMAD, which allows an attacker to run arbitrary SQL when code using ADOdb with a PostgreSQL database passes user-supplied data to the driver's pg_insert_id() method. Moodle core does not call this method, so only sites running third-party code that does are exposed. Moodle tracks this issue as MSA-25-0031 (MDL-85375).

Per OWASP: A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system.

This issue affects all versions of Moodle before 4.1.19, versions 4.2.0 through 4.4.8, versions 4.5.0 through 4.5.4, and version 5.0.0, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (bundled adodb/adodb-php in lib/adodb)
• Affected versions: <4.1.19, >=4.2.0 <4.4.9, >=4.5.0 <4.5.5, >=5.0.0 <5.0.1
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.1.19, 4.4.9, 4.5.5, 5.0.1 (ADOdb 5.22.9)
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Critical-severity vulnerability is found in the ADOdb library bundled in the moodle/moodle package in all versions before 4.1.19, 4.2.0 through 4.4.8, 4.5.0 through 4.5.4, and 5.0.0 of Moodle, and in IOMAD releases built on those versions. The upstream issue affects ADOdb versions before 5.22.9 (GHSA-8x27-jwjr-8545), and its CVSS score reflects the worst case in which an application passes user input to the vulnerable method. Moodle rates it Serious.

ADOdb's PostgreSQL drivers (postgres64, postgres7, postgres8 and postgres9) share the ADODB_postgres64 class in drivers/adodb-postgres64.inc.php. Its pg_insert_id() method reads the last value of a sequence by building the sequence name from a table name and a field name and pasting it straight into the query:

// get the last id - never tested
function pg_insert_id($tablename,$fieldname)
{
    $result=pg_query($this->_connectionID, 'SELECT last_value FROM '. $tablename .'_'. $fieldname .'_seq');
    if ($result) {
        $arr = @pg_fetch_row($result,0);
        pg_free_result($result);
        if (isset($arr[0])) return $arr[0];
    }
    return false;
}

Neither $tablename nor $fieldname is quoted or escaped. If either value comes from a user, the user can close the identifier and append their own SQL, which then runs with the privileges of the database account the connection uses. Depending on that account, this can expose or change any data it can reach.

Moodle's advisory states that core Moodle does not call pg_insert_id(), so a standard installation is not exploitable through this method. The risk is limited to sites where a third-party plugin or custom code uses the bundled ADOdb with a PostgreSQL connection and passes user-supplied values to pg_insert_id(). Moodle updated the library as a precaution so that such code is no longer exposed.

ADOdb 5.22.9 builds the sequence name first and quotes it with PHP's pg_escape_identifier() before it goes into the query, so the value is always treated as a single identifier. The method is also marked deprecated in favour of insert_ID():

function pg_insert_id($tablename, $fieldname)
{
    $sequence = pg_escape_identifier($this->_connectionID, $tablename .'_'. $fieldname .'_seq');
    $result = pg_query($this->_connectionID, 'SELECT last_value FROM '. $sequence);

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.1.19, 4.4.9, 4.5.5, 5.0.1, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Marco Nappi (finder, upstream ADOdb advisory)