Moodle SQL Injection

Moodle.org PATH/moodle/ing/blocks/mrbs/code/web/viewentry.php?id=SQL&day=27&month=10&year=2007 And a POC: PATH/moodle/ing/blocks/mrbs/code/web/viewentry.php?id=200020UNION20SELECT20username,id,id,id,id,id,id,id,id,id,id,id20FROM20mdluser20WHERE20id=ID&day=27&month=10&year=2007...

MRBS 1.2.x - view_entry.php SQL Injection

MRBS 1.2.x - viewentry.php SQL Injection source: https://www.securityfocus.com/bid/26977/info MRBS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise t...

MRBS 1.2.x - 'view_entry.php' SQL Injection

source: https://www.securityfocus.com/bid/26977/info MRBS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or...

Fedora 7 : moodle-1.8.2-1.fc7 (2007-1445)

Upgrade to 1.8.2, Security fixes for 247582. Also corrects bug 245750, cron job problem. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

openSUSE 10 Security Update : moodle (moodle-3959)

This update fixes the following issues : - possible remote file inclusion CVE-2007-1429 - XSS injection in SCORM 1.2 reports - Fixed XSS in login block Additionally changes : - Fixed visibility of site blogs - moodle-config.php is now located in /etc/moodle/ - added safemode and session.savehandl...

[SECURITY] Fedora 7 Update: moodle-1.8.2-1.fc7

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

moodle-xss.txt

Dear [email protected], 1. MustLive mustlive at websecurity.com dot ua reported crossite scripting vulnerability in Moodle 1.7.1 via search parameter of index.php, example:...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Moodle 1.7.1 allows remote attackers to inject arbitrary web script or HTML via a style expression in the search parameter, a different vulnerability than CVE-2004-1424...

CVE-2007-3555

Cross-site scripting XSS vulnerability in index.php in Moodle 1.7.1 allows remote attackers to inject arbitrary web script or HTML via a style expression in the search parameter, a different vulnerability than CVE-2004-1424...

CVE-2007-3555

Cross-site scripting XSS vulnerability in index.php in Moodle 1.7.1 allows remote attackers to inject arbitrary web script or HTML via a style expression in the search parameter, a different vulnerability than CVE-2004-1424...

CVE-2007-3555

Cross-site scripting XSS vulnerability in index.php in Moodle 1.7.1 allows remote attackers to inject arbitrary web script or HTML via a style expression in the search parameter, a different vulnerability than CVE-2004-1424...

CVE-2007-3555

CVE-2007-3555 is a cross-site scripting (XSS) vulnerability in Moodle 1.7.1’s index.php that allows an attacker to inject arbitrary script/HTML via the search parameter. The issue stems from how the style expression is handled and is listed among several Moodle vulnerabilities addressed in Debian...

Moodle 1.7.1 - index.php Cross-Site Scripting

Moodle 1.7.1 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/24748/info Moodle is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to perform cross-site scripting...

Moodle 1.7.1 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/24748/info Moodle is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context ...

Vulnerability in Moodle

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting уязвимости в Moodle. Уязвимость в параметре search в скрипте index.php. XSS: http://host/user/index.php?contextid=4&roleid=0&id=2&group=&perpage=20&search=22style=xss:expressionalertdocument.cookie20 Данный PoC предназначен дл...

iFRAME for PhpNuke (iframe.php) Remote File Include Vulnerabilities

--/ INTRODUCTION -- / Advisory : MOODLE = 1.5.2 user password read out Release Date : 17. March 2007 Application : Moodle.org is a course management system CMS : to help educators create effective online learning communities. Impact : read out user account passwords in md5 hash Googledork :...

MOODLE <= 1.5.2 user password read out

--/ INTRODUCTION -- / Advisory : MOODLE = 1.5.2 user password read out Release Date : 17. March 2007 Application : Moodle.org is a course management system CMS : to help educators create effective online learning communities. Impact : read out user account passwords in md5 hash Googledork :...

CVE-2007-1647

Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain user names, password hashes, and other sensitive information via a direct request for session sess files in...

CVE-2007-1647

Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain user names, password hashes, and other sensitive information via a direct request for session sess files in...

Improper access control

Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain user names, password hashes, and other sensitive information via a direct request for session sess files in...