Multiple vulnerabilities in Moodle

Published: 2023-05-01 | Updated: 2024-04-09

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2023-30944 CVE-2023-30943
CWE-ID	CWE-89 CWE-73
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #2 is available.
Vulnerable software Subscribe	Moodle Web applications / Other software
Vendor	moodle.org

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) SQL injection

EUVDB-ID: #VU75602

Risk: Low

CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-30944

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute limited SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote user can send a specially crafted request to the affected application and execute limited SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Moodle: 3.9.0 - 4.1.2

External links

http://moodle.org/mod/forum/discuss.php?d=446286

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) External Control of File Name or Path

EUVDB-ID: #VU75601

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-30943

CWE-ID: CWE-73 - External Control of File Name or Path

Exploit availability: Yes

Description

The vulnerability allows a remote user to create arbitrary folders on the system.

The vulnerability exists due to application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.