CVE-2008-0123

moodle < 1.8.3 - Cross-Site Scripting via install.php dbname Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-0123. PoCs published by Hanno Bock.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Moodle versions prior to 1.8.4 by injecting a malicious script into the 'dbname' parameter during the installation process.

Description

Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, allows remote attackers to inject arbitrary web script or HTML via the dbname parameter. NOTE: this issue only exists until the installation is complete.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Hanno Bock · textwebappsphp

https://www.exploit-db.com/exploits/31020

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Moodle versions prior to 1.8.4 by injecting a malicious script into the 'dbname' parameter during the installation process.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Moodle < 1.8.4

No auth needed

Prerequisites: Access to the Moodle installation page

MITRE ATT&CK