ATutor 2.2.1 - Directory Traversal / Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'ATutor 2.2.1 Directory Traversal / Remote Code Execution', 'Description' = %q This module exploits a directory traversal...

Moodle XSS

Multiple vulnerabilities exist in the Moodle learning management system module, due to the lack of measures taken to protect the website structure. Exploitation of these vulnerabilities allows attackers to inject arbitrary Web or HTML code, through the use of the “student” role and a specially...

WS-2016-7125

In “TEAMMATES/teammates”, versions V4.98 to V5.70 are vulnerable against XSS as a result of displaying unsanitized student information...

ATutor 2.2.1 Directory Traversal / Remote Code Execution

This module exploits a directory traversal vulnerability in ATutor on an Apache/PHP setup with displayerrors set to On, which can be used to allow us to upload a malicious ZIP file. On the web application, a blacklist verification is performed before extraction, however it is not sufficient to...

CVE-2015-5336

Multiple cross-site scripting XSS vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey...

UBUNTU-CVE-2015-5336

Multiple cross-site scripting XSS vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey...

CVE-2015-5264

The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role...

CVE-2015-5336

Multiple cross-site scripting XSS vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey...

CVE-2015-5336

Multiple cross-site scripting XSS vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey...

CVE-2015-5336: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey...

CVE-2015-5264: Undefined Security Weakness

The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role...

Golestan System Of Iran SQL Injection

In The Name Of God Exploit Title : Golestan System Of Iran Login Bypass Vulnerability Exploit Author : 4TT4CK3R Tested on : Internet Explorer , Kali Linux , Windows 8.1 HomePage : https://reg.pnu.ac.ir Vendor Page : https://reg1.pnu.ac.ir/forms/authenticateuser/main.htm Thanks to : Behrooz...

Banner Student Product URL Redirection Vulnerability

Banner Student is used to query and manage student records and information. A URL redirection vulnerability exists in the Banner Student product, which can be exploited by an attacker to redirect to a malicious page...

Department of Education Lambasted Over Database Vulnerabilities

Like the Office of Personnel Management before it, the Department of Education has failed to heed repeated warnings that its systems contain multiple weaknesses. In a House Committee on Oversight and Government Reform hearing held this week, Congressman and committee chair Jason Chaffetz R-Utah...

src.ac.uk XSS vulnerability

Vulnerable URL: http://www.src.ac.uk/student-life/134-courses/part-time-courses/engineering-skills/641-recreational-welding? Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 22:42 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

Moodle Access Information Disclosure

The vulnerability of the Moodle learning management system’s sub-component, lib/navigationlib.php, is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information using the student...

This 20-year-old Student Has Written 100 Malware Programs in Two Years

Security firm Trend Micro has identified a 20-year-old Brazilian college student responsible for developing and distributing over 100 Banking Trojans selling each for around US$300. Known online as 'Lordfenix', 'Hacker's Son' and 'Filho de Hacker', the computer science student first began his...

Moodle 'mod/quiz/report/statistics/statistics_question_table.php' cross-site scripting vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in the Moodle 'mod/quiz/report/statistics/statisticsquestiontable.php' script. A remote...

CVE-2015-2273

Cross-site scripting XSS vulnerability in mod/quiz/report/statistics/statisticsquestiontable.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a...