Cross-site Request Forgery (CSRF)

Moodle is vulnerable to cross-site request forgery CSRF attacks. A session key isn't present when setting a tracker preference. This allows remote attackers to hijack the authentication of users requesting a tracker preference...