bugtraq - Moodle XSS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040713155408.18582.qmail@www.securityfocus.com>
Date: 13 Jul 2004 15:54:08 -0000
From: Thomas Waldegger <morpheus@...a.info>
To: bugtraq@...urityfocus.com
Subject: Moodle XSS Vulnerability

Moodle XSS Vulnerability (13.07.04)

Vendor:  Moodle
URL:     http://moodle.org/
Version: Moodle 1.3.2+, Moodle 1.4 dev
Risk:    XSS

Description:
"Moodle is a course management system (CMS) - a software package designed to help educators create quality online courses."

See http://moodle.org/ for a detailed description.

Cross Site Scripting:
It's possible to inject HTML or JavaScript code into the variable "file" of help.php. The bug is similar to the vuln discovered by Bartek Nowotarski [1].

http://www.example.com/help.php?file={XSS}

Solution:
Martin Dougiamas the lead developer of Moodle fixed the bug in CVS Stable and Development but there is not any new release yet.

Here [2] you can find the patched version of help.php.

> $file = clean_text($file);
> notify("Help file '$file' could not be found!");

Credits:
Thomas Waldegger (morpheus)

BuHa-Security Board
http://www.buha.info/board/

[1] http://www.securityfocus.com/archive/1/361841
[2] http://cvs.sourceforge.net/viewcvs.py/moodle/moodle/help.php