CVE-2019-3810
MEDIUMmoodle 3.1.0-3.1.15 3.6.0-3.6.1 - Cross-Site Scripting in User Profile Image Hover Text
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2019-3810. PoCs published by Fariskhi Vidyan, farisv.
AI-analyzed exploit summary This exploit demonstrates a persistent XSS vulnerability in Moodle versions prior to 3.6.2, 3.5.4, 3.4.7, and 3.1.16. The PoC leverages a stored XSS in the user profile fields to execute JavaScript, which then escalates the attacker's privileges to administrator by extracting the sesskey and making a POST request to the admin role assignment endpoint.
Description
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.
Exploits (2)
This exploit demonstrates a persistent XSS vulnerability in Moodle versions prior to 3.6.2, 3.5.4, 3.4.7, and 3.1.16. The PoC leverages a stored XSS in the user profile fields to execute JavaScript, which then escalates the attacker's privileges to administrator by extracting the sesskey and making a POST request to the admin role assignment endpoint.
This is a working PoC for CVE-2019-3810, a stored XSS vulnerability in Moodle that allows privilege escalation from student to admin. The exploit involves injecting malicious JavaScript via user profile fields, which executes when an admin visits the `/userpix/` page.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N