Moodle CMS 3.1.2 Cross Site Scripting / File Upload

`Title: Multiple Vulnerabilities - Moodle CMS -3.1.2  
Application: Moodle CMS  
Versions Affected: <= 3.1.2  
Vendor URL: https://moodle.org/  
Software URL: https://download.moodle.org/  
Discovered by: Joel Vadodil Varghese  
Tested on: Windows 10 Pro  
Bugs: Persistent Cross Site Scripting, Non-Persistent Cross Site Scripting  
and Arbitrary File Upload  
Date: 13-Sept-2016  
  
Details:  
--------  
- Parameters "s_additionalhtmlhead", "s_additionalhtmltopofbody" and  
"s_additionalhtmlfooter" are vulnerable to Stored XSS (Requires admin  
access)  
- Parameter "add these tags" is vulnerable to Non-Persistent XSS (Requires  
normal user access)  
- Possible to upload ".jpg.test" file in the image section (Requires normal  
user access)  
- Possible to upload ".exe" files in legacy course files and file  
manager (Requires  
normal user access)  
`