CVE-2019-11631

This Metasploit module exploits a command execution vulnerability in Moodle 3.6.3 by uploading a malicious plugin via the 'Install Plugin' feature. The exploit requires admin credentials and leverages a crafted ZIP file containing PHP code to achieve remote command execution.

This Metasploit module exploits a feature in Moodle (misclassified as CVE-2019-11631) to upload a malicious plugin via admin credentials, achieving remote code execution (RCE) by embedding a base64-encoded payload in an HTTP header. The plugin is automatically installed, triggered, and then uninstalled to minimize traces.