CVE-2020-14321

CVE-2020-14321 コース登録により、教師ロールからマネージャーロールへの権限昇格が可能になり、RCE に至る 誰かが Python スクリプトを必要とするかもしれないので、それを悪用するスクリプトを作成しました。 この PoC の使用方法: How to use this PoC script Case 1. If you have vaid credentials: python3 cve202014321.py -u http://test.local:8080 -u teacher -p 1234 -cmd=dir Case 2. If you have valid...

CVE-2020-14321

Python 脚本用于利用 CVE-2020-14321 - Moodle 3.9 课程注册允许从教师角色提权为管理者角色以执行远程代码。 某课程的教师可以在此课程中将自己分配为管理者角色。 Payload 来源：https://github.com/HoangKien1020/CVE-2020-14321 使用方法 如果你有有效的教师凭据（现实生活中尚未充分测试，也可能已经测试过，谁知道呢：P）： root@kitploit: ❭ python3 CVE-2020-14321RCE.py http://moodle.site.com/moodle -u lanz -p...

Exploit for Incorrect Authorization in Moodle

Python script to exploit CVE-2020-14321https://moodle.org/mod...

Exploit for Incorrect Authorization in Moodle

CVE-2020-14321 Course enrolments allowed privilege escalation...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Campus Virtual-LMS allow remote attackers to inject arbitrary web script or HTML via the 1 courseid parameter to enrolments/step1.php, or the 2 search or 3 siteid parameter to files/sharedlist.php...

CVE-2009-2149

Multiple cross-site scripting XSS vulnerabilities in Campus Virtual-LMS allow remote attackers to inject arbitrary web script or HTML via the 1 courseid parameter to enrolments/step1.php, or the 2 search or 3 siteid parameter to files/sharedlist.php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Campus Virtual-LMS allow 1 remote attackers to hijack the authentication of arbitrary users for requests that terminate a session via login/logout.php, and might allow remote attackers to hijack the authentication of certain users via a ...

CVE-2009-2149

Multiple cross-site scripting XSS vulnerabilities in Campus Virtual-LMS allow remote attackers to inject arbitrary web script or HTML via the 1 courseid parameter to enrolments/step1.php, or the 2 search or 3 siteid parameter to files/sharedlist.php...

campus virtual-lms - Cross-Site Scripting SQL Injection

campus virtual-lms - Cross-Site Scripting SQL Injection +-----------------------------------------------------------------------------+ LMS: Campus Virtual-LMS WEB: http://campusvirtualcomputrade.cae.net Autor: Yasión Fecha: 12 jun 2009...