lsuits/gradebook_moodle — Issue #8: Security bug in QE
Author: rrusso
Created: 2012-03-07 16:03:03+00:00
State: open

If a professor realizes you can simply type in the itemid, they can edit any course grade item including category ones.

example:

Log in as kattest.

http://beta.moodle.lsu.edu/grade/report/quick_edit/index.php?id=7&item=grade&itemid=647&group=

You can edit the final grade for her course.

You, however, CAN NOT edit grades from other courses, so that's good.