Moodle 'texed.php' Remote Command Execution Vulnerability

Bugtraq ID:	32801
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 12 2008 12:00AM
Updated:	Dec 30 2008 04:11PM
Credit:	Antonio "s4tan" Parata, Francesco "ascii" Ongaro, Giovanni "evilaliv3" Pellerano
Vulnerable:	Red Hat Fedora 9 Moodle moodle 1.9.3
Not Vulnerable:

Moodle 'texed.php' Remote Command Execution Vulnerability

Moodle s prone to a vulnerability that attackers can leverage to execute arbitrary commands. This issue occurs because the application fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected application and possibly the underlying computer.

Moodle 1.9.3 is vulnerable; other versions may also be affected.

Moodle 'texed.php' Remote Command Execution Vulnerability

The following example URI is available:

http://www.example.com/moodle/filter/tex/texed.php?formdata=foo&pathname=foo";ls+-l;echo+"
http://www.example.com/moodle/filter/tex/texed.php?formdata=foo&pathname=foo"+||+dir+||+echo+

Moodle 'texed.php' Remote Command Execution Vulnerability

Solution:
Fixes are available. Please see the references for more information.

Moodle 'texed.php' Remote Command Execution Vulnerability

References:

• Diff of /moodle/filter/tex/texed.php (Moodle)
  
• Moodle Homepage (Moodle)
  
• Moodle Revision 1.10 (Moodle)
  
• Moodle 1.9.3 Remote Code Execution (ascii )
  
• Re: Moodle 1.9.3 Remote Code Execution ([email protected])
  
• Re: Moodle 1.9.3 Remote Code Execution ("Jamie Riden" )
  
• Re: Moodle 1.9.3 Remote Code Execution ([email protected])