CVE-2023-30943

This PoC demonstrates two Moodle vulnerabilities: unauthenticated arbitrary folder creation leading to stored XSS and self-XSS leading to account takeover. The exploit combines these techniques to showcase potential RCE and privilege escalation paths.

This repository contains a Python-based scanner for detecting CVE-2023-30943, a vulnerability in Moodle that allows arbitrary folder creation via crafted HTTP requests to the TinyMCE loader. The tool supports single URL checks, bulk scanning from files, and integration with Leakix for fetching potential targets.

This PoC demonstrates a combination of unauthenticated arbitrary folder creation leading to stored XSS and a self-XSS leading to account takeover in Moodle. The exploit leverages directory traversal and XSS payloads to achieve remote code execution and session hijacking.