BID:33881

Moodle User Edit Form Unspecified Remote Privilege Escalation Vulnerability

Info

Moodle User Edit Form Unspecified Remote Privilege Escalation Vulnerability

Bugtraq ID:	33881
Class:	Input Validation Error
CVE:	CVE-2008-6125
Remote:	Yes
Local:	No
Published:	Jan 17 2008 12:00AM
Updated:	Feb 24 2009 08:57PM
Credit:	Gustav Delius
Vulnerable:	Moodle moodle 1.7.2 Moodle moodle 1.7.1 Moodle moodle 1.6.5 Moodle moodle 1.6.4 Moodle moodle 1.6.3 Moodle moodle 1.6.2 Moodle moodle 1.6.1 Moodle moodle 1.6 dev Moodle moodle 1.6 Moodle moodle 1.5.2 Moodle moodle 1.5.1 Moodle moodle 1.5 Moodle moodle 1.7 Moodle moodle 1.6.1 + Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 BEA Systems Weblogic Proxy Plugin 1.5.3 + BEA Systems Weblogic Proxy Plugin 1.5.3

Not Vulnerable:	Moodle moodle 1.7.3 Moodle moodle 1.6.6

Discussion

Moodle User Edit Form Unspecified Remote Privilege Escalation Vulnerability

Moodle is prone to a remote privilege-escalation vulnerability.

Attackers can exploit this issue to gain elevated access to the affected application. Successful exploits may aid in further attacks.

The following Moodle branches and corresponding versions are affected:

1.7.x (prior to 1.7.3)
1.6.x (prior to 1.6.6)
1.5.x

Exploit / POC

Moodle User Edit Form Unspecified Remote Privilege Escalation Vulnerability

An attacker can exploit this issue via a browser.

Solution / Fix

Moodle User Edit Form Unspecified Remote Privilege Escalation Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.

Debian Linux 4.0 amd64