Moodle Cross Site Scripting Vulnerability
BID:10251
Info
Moodle Cross Site Scripting Vulnerability
| Bugtraq ID: | 10251 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 30 2004 12:00AM |
| Updated: | Apr 30 2004 12:00AM |
| Credit: | Bartek Nowotarski <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
Moodle moodle 1.2.1 Moodle moodle 1.2 Moodle moodle 1.1.1 |
| Not Vulnerable: |
Moodle moodle 1.3 |
Discussion
Moodle Cross Site Scripting Vulnerability
It has been reported that Moodle is susceptible to a cross-site scripting vulnerability in the 'help.php' script. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamic web content.
This issue may allow for theft of cookie-based authentication credentials. Other attacks are also possible.
It has been reported that Moodle is susceptible to a cross-site scripting vulnerability in the 'help.php' script. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamic web content.
This issue may allow for theft of cookie-based authentication credentials. Other attacks are also possible.
Exploit / POC
Moodle Cross Site Scripting Vulnerability
No exploit is required. The following proof of concept was provided:
http://www.example.com/help.php?text={XSS}
No exploit is required. The following proof of concept was provided:
http://www.example.com/help.php?text={XSS}
Solution / Fix
Moodle Cross Site Scripting Vulnerability
Solution:
The vendor has released an upgrade dealing with this issue.
Moodle moodle 1.1.1
Moodle moodle 1.2
Moodle moodle 1.2.1
Solution:
The vendor has released an upgrade dealing with this issue.
Moodle moodle 1.1.1
-
Moodle moodle-latest.tgz
This is the latest development version that will become version 1.3 of the software. The fix for this issue has been incorporated into the product and will be included in the next official release.
http://moodle.org/download.php/moodle/moodle-latest.tgz
Moodle moodle 1.2
-
Moodle moodle-latest.tgz
This is the latest development version that will become version 1.3 of the software. The fix for this issue has been incorporated into the product and will be included in the next official release.
http://moodle.org/download.php/moodle/moodle-latest.tgz
Moodle moodle 1.2.1
-
Moodle moodle-latest.tgz
This is the latest development version that will become version 1.3 of the software. The fix for this issue has been incorporated into the product and will be included in the next official release.
http://moodle.org/download.php/moodle/moodle-latest.tgz
References
Moodle Cross Site Scripting Vulnerability
References:
References:
- Moodle Home Page (Moodle)
- Cross Site Scripting in Moodle < 1.3 (Bartek Nowotarski