Moodle XSS Vulnerability (13.07.04)
Vendor: Moodle
URL: http://moodle.org/
Version: Moodle 1.3.2+, Moodle 1.4 dev
Risk: XSS
Description:
"Moodle is a course management system (CMS) - a software package designed to
help educators create quality online courses."
See http://moodle.org/ for a detailed description.
Cross Site Scripting:
It's possible to inject HTML or JavaScript code into the variable "file" of
help.php. The bug is similar to the vuln discovered by Bartek Nowotarski [1].
http://www.example.com/help.php?file={XSS}
Solution:
Martin Dougiamas the lead developer of Moodle fixed the bug in CVS Stable and
Development but there is not any new release yet.
Here [2] you can find the patched version of help.php.
> $file = clean_text($file);
> notify("Help file '$file' could not be found!");
Credits:
Thomas Waldegger (morpheus)
BuHa-Security Board
http://www.buha.info/board/
[1] http://www.securityfocus.com/archive/1/361841
[2] http://cvs.sourceforge.net/viewcvs.py/moodle/moodle/help.php