The version of Moodle installed on the remote host fails to properly sanitize user-supplied input to the 'badge' parameter of the 'external.php' script. The application also fails to properly sanitize serialized objects. An attacker can exploit these issues by crafting a URL containing a serialized object that will inject arbitrary HTML or script code in a users browser. By enticing a user to view this URL, the attacker can exploit these flaws.

Note that the unserialization attack mentioned here can be used to perform additional attacks; however, Nessus has only tested for a cross-site scripting vulnerability.

リモートホストにインストールされている Moodle のバージョンは、「external.php」スクリプトの「badge」パラメーターへのユーザー指定の入力を適切にサニタイズすることに失敗しています。また、そのアプリケーションも、シリアル化されたオブジェクトを適切にサニタイズすることに失敗しています。攻撃者は、これらの問題を悪用して、シリアル化されたオブジェクトを含む URL を細工することで、ユーザーのブラウザに任意の HTML またはスクリプトコードを注入する可能性があります。ユーザーを誘導して、この URL を閲覧させることで、攻撃者は、これらの欠陥を悪用できます。

注意：ここで言及されているシリアル化が解除された攻撃を使用することで、さらに別の攻撃を仕掛けることができますが、Nessus は、クロスサイトスクリプティングの脆弱性以外はテストしていません。

遠端主機上安裝的 Moodle 版本無法正確清理使用者向 'external.php' 指令碼之 'badge' 參數提供的輸入。此應用程式也無法正確清理序列化的物件。攻擊者可惡意利用這些問題，透過特製包含序列化物件的 URL，在使用者瀏覽器中插入任意 HTML 或指令碼。攻擊者可誘騙使用者檢視此 URL，藉以惡意利用這些瑕疵。

請注意，此處所提及的未序列化攻擊可用來執行其他攻擊，但是，Nessus 僅測試過跨網站指令碼弱點。

远程主机上安装的 Moodle 版本未能对用户为“external.php”脚本的“badge”参数提供的输入进行适当的审查。应用程序也未能正确审查序列化的对象。攻击者可利用这些问题，方法是构建包含序列化的对象的 URL，该对象在用户浏览器中注入任意 HTML 或脚本代码。攻击者可通过诱骗用户查看此 URL 来利用这些缺陷。

请注意，可利用此处介绍的反序列化攻击执行更多攻击，但是 Nessus 仅针对跨站脚本漏洞进行了测试。

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.3.x prior to 2.3.9, 2.4.x prior to 2.4.6 or 2.5.x prior to 2.5.2 are exposed to the following vulnerabilities :

 - One of Moodle's dependencies, the PHP cURL Library (libcurl), contains a flaw related to domain name validation during certificate validation.  The issue is due to the server hostname not being verified to match a domain name in the Subject's Common Name (CN) or SubjectAltName field of the X.509 certificate.  This may allow a man-in-the-middle attacker to spoof SSL servers via an arbitrary certificate that appears valid.  Such an attack would allow for the interception of sensitive traffic, and potentially allow for the injection of content into the SSL stream. (CVE-2012-6087)
 - A flaw exists that may allow an attacker to carry out an SQL injection attack.  The issue is triggered when handling NULL bytes from a query string.  This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data. (CVE-2013-4313)
 - A flaw exists that allows a stored cross-site scripting (XSS) attack.  This flaw exists because the application does not validate input passed via links upon submission to the 'blog/external_blog_edit.php' script.  This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. (CVE-2013-4341)
 - A flaw exists that is due to unserialized input in the 'badges/external.php' script.  This may allow a remote attacker to inject objects leading to the deletion of arbitrary files via 'csv_export_writer::__destruct()' method in 'lib/csvlib.class.php' or conduct cross-site scripting (XSS) attacks via the 'core_badges_renderer::render_external_badge()' method in 'badges/renderer.php'. (CVE-2013-5674)

ID	名稱	產品	系列	已發布	已更新	嚴重性
70023	Moodle 'external.php' 'badge' Parameter XSS	Nessus	CGI abuses : XSS	2013/9/20	2024/6/6	medium
70023	Moodle「external.php」「badge」パラメーターの XSS	Nessus	CGI abuses : XSS	2013/9/20	2024/6/6	medium
70023	Moodle 'external.php' 'badge' 參數 XSS	Nessus	CGI abuses : XSS	2013/9/20	2024/6/6	medium
70023	Moodle“external.php”“badge”参数 XSS	Nessus	CGI abuses : XSS	2013/9/20	2024/6/6	medium
9418	Moodle 2.3.x < 2.3.9 / 2.4.x < 2.4.6 / 2.5.x < 2.5.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2016/7/21	2019/3/6	high

偵測

搜尋 Plugin

medium

medium

medium

medium

high