PT-2023-3325 · Moodle+2 · Moodle+2

Paul Holden · CVE-2023-30944 · Publicado 2020-11-08 · Atualizado 2024-04-19

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description The issue exists due to insufficient sanitization of user-supplied data in the external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database. This could potentially allow the attacker to read, delete, or modify data in the database and gain full control over the vulnerable application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

ALT-PU-2020-3235

ALT-PU-2023-2012

ALT-PU-2023-2057

ALT-PU-2023-5127

BDU:2023-03480

BIT-MOODLE-2023-30944

CVE-2023-30944

GHSA-7MMC-22G7-3XQ2

Produtos afetados

Alt Linux

Moodle

Red Os

Referências · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30944.json · Exploit
• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/5521d1d6e8bb8bebb76ad8154095f6b18ea26e7f · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-moodle-cve-2023-23923-cve-2023-23922-cve-2023-23921-cve-2022-0332-cve-202 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZBWRVUJF7HI53XCJPJ3YJZPOV5HBRUY · Aviso do Fabricante
• https://goslinux.fssp.gov.ru/2726972 · Nota de Segurança
• https://moodle.org/mod/forum/discuss.php?d=446286 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-03480 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-30944 · Aviso do Fabricante
• https://t.me/cvenotify/50211 · Publicação no Telegram
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBFSXRYLT4ICKJVQSRBAOUDMDRVSVBLS · Aviso do Fabricante
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77187 · Correção
• https://osv.dev/vulnerability/BIT-moodle-2023-30944 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MZBWRVUJF7HI53XCJPJ3YJZPOV5HBRUY · Aviso do Fabricante
• https://git.moodle.org · Nota