CVE-2013-4341
Moodle < 2.2.11, 2.3.x < 2.3.9, 2.4.x < 2.4.6, 2.5.x < 2.5.2 - Cross-Site Scripting via RSS Feed Blog Link
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-4341.
PoCs published by Ciaran McNally, including Metasploit module exploits/multi/http/moodle_spelling_binary_rce.
AI-analyzed exploit summary This exploit demonstrates a persistent XSS vulnerability in Moodle versions <= 2.3.8 and 2.4.5. The vulnerability allows an attacker to inject malicious JavaScript via the RSS feed link parameter, which executes when a user clicks the 'Link to original blog entry' link.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or HTML via a crafted blog link within an RSS feed.
Exploits (2)
This exploit demonstrates a persistent XSS vulnerability in Moodle versions <= 2.3.8 and 2.4.5. The vulnerability allows an attacker to inject malicious JavaScript via the RSS feed link parameter, which executes when a user clicks the 'Link to original blog entry' link.
This Metasploit module exploits an authenticated RCE vulnerability in Moodle by manipulating the spellchecker path to execute arbitrary commands. It also leverages a secondary XSS vulnerability to escalate privileges if needed.