Moodle 'external.php' CVE-2013-5674 PHP Object Injection Vulnerability

Bugtraq ID:	62412
Class:	Input Validation Error
CVE:	CVE-2013-5674
Remote:	Yes
Local:	No
Published:	Sep 16 2013 12:00AM
Updated:	Apr 13 2015 10:12PM
Credit:	Emilio Pinna
Vulnerable:	Moodle Moodle 2.5.1 Moodle Moodle 2.5
Not Vulnerable:	Moodle Moodle 2.5.2

Moodle 'external.php' CVE-2013-5674 PHP Object Injection Vulnerability

Moodle is prone to a remote PHP object-injection vulnerability.

Attackers can exploit this issue to inject arbitrary object in to the application. This may allow an attacker to delete files and perform cross-site scripting attacks

Moodle 'external.php' CVE-2013-5674 PHP Object Injection Vulnerability

An attacker can exploit this issue using a web browser.

Moodle 'external.php' CVE-2013-5674 PHP Object Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Moodle 'external.php' CVE-2013-5674 PHP Object Injection Vulnerability

References:

• Moodle 2.5.0-1 badges/external.php PHP Object Injection (Emilio Pinna)
  
• Moodle security notifications public (Moodle)
  
• Moodle weekly release 2.6dev (Moodle)