Moodle CMS 3.1.2 Cross Site Scripting / File Upload
Posted on 02 November 2016
Title: Multiple Vulnerabilities - Moodle CMS -3.1.2 Application: Moodle CMS Versions Affected: <= 3.1.2 Vendor URL: https://moodle.org/ Software URL: https://download.moodle.org/ Discovered by: Joel Vadodil Varghese Tested on: Windows 10 Pro Bugs: Persistent Cross Site Scripting, Non-Persistent Cross Site Scripting and Arbitrary File Upload Date: 13-Sept-2016 Details: -------- - Parameters "s_additionalhtmlhead", "s_additionalhtmltopofbody" and "s_additionalhtmlfooter" are vulnerable to Stored XSS (Requires admin access) - Parameter "add these tags" is vulnerable to Non-Persistent XSS (Requires normal user access) - Possible to upload ".jpg.test" file in the image section (Requires normal user access) - Possible to upload ".exe" files in legacy course files and file manager (Requires normal user access)
