Moodle CMS 3.1.2 Cross Site Scripting / File Upload Vulnerabilities

Title: Multiple Vulnerabilities - Moodle CMS -3.1.2
Application: Moodle CMS
Versions Affected: <= 3.1.2
Vendor URL: https://moodle.org/
Software URL: https://download.moodle.org/
Discovered by: Joel Vadodil Varghese
Tested on: Windows 10 Pro
Bugs: Persistent Cross Site Scripting, Non-Persistent Cross Site Scripting
and Arbitrary File Upload
Date: 13-Sept-2016

Details:
--------
- Parameters "s_additionalhtmlhead", "s_additionalhtmltopofbody" and
"s_additionalhtmlfooter" are vulnerable to Stored XSS (Requires admin
access)
- Parameter "add these tags" is vulnerable to Non-Persistent XSS (Requires
normal user access)
- Possible to upload ".jpg.test" file in the image section (Requires normal
user access)
- Possible to upload ".exe" files in legacy course files and file
manager (Requires
normal user access)

#  0day.today [2018-03-13]  #