CVE-2019-3810

This exploit demonstrates a persistent XSS vulnerability in Moodle versions prior to 3.6.2, 3.5.4, 3.4.7, and 3.1.16. The PoC leverages a stored XSS in the user profile fields to execute JavaScript, which then escalates the attacker's privileges to administrator by extracting the sesskey and making a POST request to the admin role assignment endpoint.

This is a working PoC for CVE-2019-3810, a stored XSS vulnerability in Moodle that allows privilege escalation from student to admin. The exploit involves injecting malicious JavaScript via user profile fields, which executes when an admin visits the `/userpix/` page.