Remote code execution

2023-11-0920:15:00

PRIOn knowledge base

www.prio-n.com

remote code execution

misconfigured environment

shared hosting

moodle user

web server access

7.6 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

70.9%

JSON

In a shared hosting environment that has been misconfigured to allow access to other users’ content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.

CPENameOperatorVersion
extra_packages_for_enterprise_linuxeq7.0
fedoraeq38
moodlege4.2.0
moodlelt4.2.3
moodlege4.1.0
moodlelt4.1.6
moodlege4.0.0
moodlelt4.0.11
moodlege3.11.0
moodlelt3.11.17

Name	Operator	Version
extra_packages_for_enterprise_linux	eq	7.0
fedora	eq	38
moodle	ge	4.2.0
moodle	lt	4.2.3
moodle	ge	4.1.0
moodle	lt	4.1.6
moodle	ge	4.0.0
moodle	lt	4.0.11
moodle	ge	3.11.0
moodle	lt	3.11.17