ID:234 - Exploit for Stored cross-site scripting in Moodle - CVE-2019-3847

Link to public exploit:

Vulnerability description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in user's Dashboard. A remote authenticated attacker can permanently inject JavaScript into Dashboard and execute it victim's browser in context of vulnerable website, when a privileged user with "login as other users" capability view compromised Dashboard on attackers behalf.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation