OLIB 7 WebView 2.5.1.1 (infile) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================== OLIB 7 WebView 2.5.1.1 infile Local File Inclusion Vulnerability ================================================================== Security Advisory for 'OLIB 7 Webview'...

Moodle <= 1.8.4 Remote Code Execution Exploit

No description provided by source. ?php / Moodle = 1.8.4 remote code execution / $url = 'http://target.ru/moodle'; $proxy = 'localhost:8118'; $code = $argv1; if!$code echo 'Sample use: '.$argv0.' "phpinfo" phpinfo.html '.$argv0.' "echo set" '.$argv0.'...

Moodle 'lib/kses.php' 'kses_bad_protocol_once' Function Arbitrary PHP Code Execution

The version of Moodle on the remote host includes a version of the KSES HTML filtering library that does not safely call 'pregreplace' in the function 'ksesbadprotocolonce' in 'lib/kses.php'. An unauthenticated, remote attacker can leverage this issue to inject arbitrary PHP code that will be...

Moodle <= 1.8.4 Remote Code Execution Exploit

Exploit for unknown platform in category web applications ============================================= Moodle phpinfo.html '.$argv0.' "echo set" '.$argv0.' /full/local/path/to/file/for/upload/phpshell.php '; exit; $upload = false; iffileexists$code && isfile$code $upload = $code; $code =...

Moodle 1.8.4 - Remote Code Execution

Moodle 1.8.4 - Remote Code Execution phpinfo.html '.$argv0.' "echo set" '.$argv0.' /full/local/path/to/file/for/upload/phpshell.php '; exit; $upload = false; iffileexists$code && isfile$code $upload = $code; $code = 'moveuploadedfile$FILESfiletmpname, basename$FILESfilename'; $code .= ';exit;';...

moodle-exec.txt

phpinfo.html '.$argv0.' "echo set" '.$argv0.' /full/local/path/to/file/for/upload/phpshell.php '; exit; $upload = false; iffileexists$code && isfile$code $upload = $code; $code = 'moveuploadedfile$FILESfiletmpname, basename$FILESfilename'; $code .= ';exit;'; $injectionpoints = array...

Moodle 1.8.4 - Remote Code Execution

phpinfo.html '.$argv0.' "echo set" '.$argv0.' /full/local/path/to/file/for/upload/phpshell.php '; exit; $upload = false; iffileexists$code && isfile$code $upload = $code; $code = 'moveuploadedfile$FILESfiletmpname, basename$FILESfilename'; $code .= ';exit;'; $injectionpoints = array...

openSUSE 10 Security Update : moodle (moodle-5488)

Moodle was prone to a Cross-Site scripting flaw which could potentially be exploited to compromise arbitrary accounts CVE-2008-3326. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update moodle-5488...

openSUSE 10 Security Update : moodle (moodle-5487)

Moodle was prone to CSRF CVE-2008-3325 / XSS CVE-2008-3326 flaws which could potentially be exploited to compromise arbitrary accounts. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

Cross site scripting

Cross-site scripting XSS vulnerability in blog/edit.php in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to inject arbitrary web script or HTML via the etitle parameter blog entry title...

CVE-2008-3327

Moodle 1.6.5, when displayerrors is enabled, allows remote attackers to obtain sensitive information via a direct request to 1 blog/blogpage.php and 2 course/report/stats/report.php, which reveals the installation path in an error message...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile settings and gain privileges as other users via a link or IMG tag to the user edit profile page...

CVE-2008-3326

Cross-site scripting XSS vulnerability in blog/edit.php in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to inject arbitrary web script or HTML via the etitle parameter blog entry title...

CVE-2008-3325

Cross-site request forgery CSRF vulnerability in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile settings and gain privileges as other users via a link or IMG tag to the user edit profile page...

Information disclosure

Moodle 1.6.5, when displayerrors is enabled, allows remote attackers to obtain sensitive information via a direct request to 1 blog/blogpage.php and 2 course/report/stats/report.php, which reveals the installation path in an error message...

CVE-2008-3327

Moodle 1.6.5, when displayerrors is enabled, allows remote attackers to obtain sensitive information via a direct request to 1 blog/blogpage.php and 2 course/report/stats/report.php, which reveals the installation path in an error message...

CVE-2008-3325

CVE-2008-3325 affects Moodle 1.6.x (before 1.6.7) and 1.7.x (before 1.7.5). The described CSRF flaw allows remote attackers to modify profile settings and gain privileges as other users via links or IMG tags to the user edit profile page. Connected sources corroborate the vulnerability in Moodle’...

CVE-2008-3327

Moodle 1.6.5, when displayerrors is enabled, allows remote attackers to obtain sensitive information via a direct request to 1 blog/blogpage.php and 2 course/report/stats/report.php, which reveals the installation path in an error message...

CVE-2008-3326

CVE-2008-3326 is a cross-site scripting flaw in Moodle’s blog/edit.php that allows injecting script/HTML via the etitle entry title. Affected: Moodle 1.6.x up to 1.6.7 and Moodle 1.7.x up to 1.7.5. Root cause: XSS in blog entry title handling. Impact: remote attacker can execute script in the vic...

CVE-2008-3325

Cross-site request forgery CSRF vulnerability in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile settings and gain privileges as other users via a link or IMG tag to the user edit profile page...