BID:11691

Moodle Multiple Unspecified Input Validation Vulnerabilities

Info

Moodle Multiple Unspecified Input Validation Vulnerabilities

Bugtraq ID:	11691
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 16 2004 12:00AM
Updated:	Nov 16 2004 12:00AM
Credit:	These vulnerabilities were disclosed to the vendor by Petr Skoda.
Vulnerable:	Moodle moodle 1.4.1 Moodle moodle 1.3.4 Moodle moodle 1.3.3 Moodle moodle 1.3.2 Moodle moodle 1.3.1 Moodle moodle 1.3 Moodle moodle 1.2.1 Moodle moodle 1.2 Moodle moodle 1.1.1

Not Vulnerable:	Moodle moodle 1.4.2

Discussion

Moodle Multiple Unspecified Input Validation Vulnerabilities

Moodle is reported susceptible to multiple unspecified input validation vulnerabilities. These vulnerabilities are due to a failure of the application to properly sanitize user-supplied input data.

These unspecified issues may be cross-site scripting, HTML injection, or SQL injection vulnerabilities.

Cross-site scripting and HTML injection issues could permit a remote attacker to cause hostile HTML or script code to be rendered in the web browser of victim users. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

SQL injection issues may be exploited to manipulate SQL queries, potentially revealing or corrupting sensitive database data. SQL injection issues may also facilitate attacks against the underlying database software.

Versions prior to 1.4.2 are reported susceptible to these vulnerabilities.

Exploit / POC

Moodle Multiple Unspecified Input Validation Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Moodle Multiple Unspecified Input Validation Vulnerabilities

Solution:
The vendor has released version 1.4.2 of the affected package to address these issues:

Moodle moodle 1.1.1