Search...

Evil Teacher: Code Injection in Moodle

2018-06-12T15:33:00

ID RIPSTECH:BEB6EBE8424B17291FAE79F3E66E0CD6
Type ripstech
Reporter RIPS Technologies Blog
Modified 2018-06-12T15:33:00

Description

Impact - Who can exploit what? An attacker must be assigned the teacher role in a course of the latest Moodle (earlier than 3.5.0) running with default configurations. Escalating to this role via another vulnerability, such as XSS, would also be possible. Given these requirements and the knowledge of the vulnerability, the adversary will be able to execute arbitrary commands on the underlying operating system of the server running Moodle.

JSON Vulners Source

Initial Source

{"id": "RIPSTECH:BEB6EBE8424B17291FAE79F3E66E0CD6", "type": "ripstech", "bulletinFamily": "blog", "title": "Evil Teacher: Code Injection in Moodle", "description": "Impact - Who can exploit what? An attacker must be assigned the teacher role in a course of the latest Moodle (earlier than 3.5.0) running with default configurations. Escalating to this role via another vulnerability, such as XSS, would also be possible. Given these requirements and the knowledge of the vulnerability, the adversary will be able to execute arbitrary commands on the underlying operating system of the server running Moodle.", "published": "2018-06-12T15:33:00", "modified": "2018-06-12T15:33:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://blog.ripstech.com/2018/moodle-remote-code-execution/", "reporter": "RIPS Technologies Blog", "references": [], "cvelist": [], "lastseen": "2019-06-11T15:43:08", "viewCount": 792, "enchantments": {"score": {"value": 4.9, "vector": "NONE", "modified": "2019-06-11T15:43:08", "rev": 2}, "dependencies": {"references": [], "modified": "2019-06-11T15:43:08", "rev": 2}, "vulnersScore": 4.9}}