Flaw Found in Moodle Online Learning Platform

guest · Jul 31, 2021

Flaw Found in Moodle Online Learning Platform
Vulnerability in Authentication Module Patched
July 30, 2021
https://www.databreachtoday.com/flaw-found-in-moodle-online-learning-platform-a-17186

The bug hunting team at pentesting firm Haxolot.com uncovered a remote code execution vulnerability in Moodle, an open-source online learning platform used by universities worldwide. The flaw has since been patched.

The flaw is present in the logout feature in Moodle's authentication module Shibboleth, which helps universities using the platform to authenticate students' identities before they're allowed to attend external courses, Haxolot researchers say. The flaw causes the logout function to invalidate the session.
Click to expand...

The vulnerability could enable attackers to perform PHP web injection to enter a malicious code, the researchers say.

"The unserializesession function [used to read every file and deserialize its contents] will detect the xxx| string as a new session key although it belongs to the serialized value of another session key," the report notes.
The researchers, who reported the bug to Moodle in February, note the company released a patch July 7. They did not report any examples of the flaw being exploited in the wild.
Click to expand...

Pre-Auth RCE in Moodle Part I - PHP Object Injection in Shibboleth

It was found that the Shibboleth authentication module of Moodle suffers from a beautiful Remote Code Execution vulnerability from the unauthenticated perspective. This is widely used among universities to allow students from one university to authenticate against other universities allowing them to attend external courses and have fiddling fun with others.
Click to expand...

Log in or Sign up

Flaw Found in Moodle Online Learning Platform

guest Guest

Log in or Sign up

Flaw Found in Moodle Online Learning Platform

guest Guest

Useful Searches