Tinymce PHP Spellchecker Plugin 'GoogleSpell.php' Multiple Remote Code Execution Vulnerabilities
BID:60060
Info
Tinymce PHP Spellchecker Plugin 'GoogleSpell.php' Multiple Remote Code Execution Vulnerabilities
| Bugtraq ID: | 60060 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-6112 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 21 2013 12:00AM |
| Updated: | May 07 2015 05:06PM |
| Credit: | Petr Škoda |
| Vulnerable: |
Moxiecode Systems AB PHP Spellchecker 2.0.6 Moodle Moodle 2.3.3 Moodle Moodle 2.3.2 Moodle Moodle 2.3.1 Moodle Moodle 2.2.6 Moodle Moodle 2.2.5 Moodle Moodle 2.2.4 Moodle Moodle 2.2.3 Moodle Moodle 2.2.2 Moodle Moodle 2.1.9 Moodle Moodle 2.1.8 Moodle Moodle 2.1.7 Moodle Moodle 2.1.6 Moodle Moodle 2.1.5 Moodle Moodle 2.1.4 Moodle Moodle 2.1.2 Moodle Moodle 2.1.1 Moodle Moodle 1.9.18 Moodle Moodle 1.9.17 Moodle Moodle 1.9.16 Moodle Moodle 1.9.14 Moodle Moodle 1.9.13 Moodle Moodle 1.9.12 Moodle Moodle 1.9.11 Moodle Moodle 1.9.10 Moodle moodle 1.9.10 Moodle Moodle 1.9.1 Moodle Moodle 2.4 Moodle Moodle 2.3 Moodle Moodle 2.2.3+ Moodle Moodle 2.2.2+ Moodle Moodle 2.1.6+ Moodle Moodle 2.1.5+ Moodle Moodle 2.1.3 Moodle Moodle 1.9.19 Moodle Moodle 1.9.18+ Moodle Moodle 1.9.17+ Moodle Moodle 1.9.15 |
| Not Vulnerable: |
Moxiecode Systems AB PHP Spellchecker 2.0.6.1 Moodle Moodle 2.4.1 Moodle Moodle 2.3.4 Moodle Moodle 2.2.7 Moodle Moodle 2.1.10 Moodle Moodle 1.9.19+ |
Discussion
Tinymce PHP Spellchecker Plugin 'GoogleSpell.php' Multiple Remote Code Execution Vulnerabilities
PHP Spellchecker plugin for TinyMCE is prone to multiple remote code-execution vulnerabilities.
An attacker can exploit these issues to execute arbitrary code in the context of the application.
Note: This issue was previously discussed in BID 57475 (Moodle Multiple Remote Security Vulnerabilities), but has been moved to its own record for better documentation.
PHP Spellchecker plugin for TinyMCE is prone to multiple remote code-execution vulnerabilities.
An attacker can exploit these issues to execute arbitrary code in the context of the application.
Note: This issue was previously discussed in BID 57475 (Moodle Multiple Remote Security Vulnerabilities), but has been moved to its own record for better documentation.
Exploit / POC
Tinymce PHP Spellchecker Plugin 'GoogleSpell.php' Multiple Remote Code Execution Vulnerabilities
An attacker can exploit these issues using a web browser.
An attacker can exploit these issues using a web browser.
Solution / Fix
Tinymce PHP Spellchecker Plugin 'GoogleSpell.php' Multiple Remote Code Execution Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Tinymce PHP Spellchecker Plugin 'GoogleSpell.php' Multiple Remote Code Execution Vulnerabilities
References:
References:
- Moodle Homepage (Moodle)
- MSA-13-0001: Security issue in Google Spellchecker in TinyMCE (Moodle)
- PHP Spellchecker Chnagelog (Moxiecode Systems AB)
- TinyMCE Spellchecker PHP 2.0.6.1 Released (Moxiecode Systems AB)