CVE-2021-21809

CRITICAL

Moodle Authenticated Spelling Binary RCE

Title source: metasploit

Description

A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.

Exploits (2)

nomisec WORKING POC 1 stars

by anldori · poc

https://github.com/anldori/CVE-2021-21809

View Code ZIP pw:eip

metasploit WORKING POC EXCELLENT

by Adam Reiser, h00die · rubypocphp

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/moodle_spelling_path_rce.rb

View Code ZIP pw:eip

References (2)

[Exploit, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/164481/Moodle-SpellChecker-Path-Authenticated-Remote-Command-Execution.html

[Exploit, Third Party Advisory] https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277

Scores

CVSS v3 9.1

EPSS 0.7290

EPSS Percentile 98.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Details

CWE

CWE-78

Status published

Products (2)

moodle/moodle 3.10.0

moodle/moodle Packagist

Published Jun 23, 2021

Tracked Since Feb 18, 2026