PT-2025-42911 · Moodle+1 · Moodle+1

Published 2025-10-21 · Updated 2025-10-21 · CVE-2025-60511

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle OpenAI Chat Block plugin version 3.0.1 (2025021700)

Description The Moodle OpenAI Chat Block plugin is affected by an Insecure Direct Object Reference (IDOR) issue. Insufficient validation of the blockId parameter in the '/blocks/openai chat/api/completion.php' API endpoint allows an authenticated student to impersonate another user’s block, such as an administrator. This can lead to exposure of administrator-only Source of Truth entries, alteration of model behavior, and potential misuse of API resources.

Recommendations Update Moodle OpenAI Chat Block plugin to a newer version that contains a fix for this vulnerability.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-60511

Affected Products

Moodle

Moodle Openai Chat Block

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-60511 · Security Note
• https://t.me/cveNotify/139670 · Telegram Post
• https://twitter.com/onurcangenc1999/status/1980728473674039445 · Twitter Post
• https://onurcangenc.com.tr/posts/idor-in-moodle-openai-chat-block-block_openai_chat-proof-of-concept-poc--cve-2025-60511 · Note
• http://moodle.com · Note
• https://github.com/onurcangnc/moodle_block_openai_chat · Note
• http://openai.com · Note