Nessus Plugin #14257

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Moodle post.php XSS

Family:

CGI abuses : XSS

Category:

infos

Copyright:

This script is Copyright (C) 2004 David Maciejak

Summary:

Determines if Moodle is vulnerable to post.php XSS

Version:

$Revision: 1.4 $

Cve_id:

-

Bugtraq_id:

10884

Xrefs:

OSVDB:8383

Description:

The remote host is running the Moodle PHP suite.

Moodle contains a flaw that allows a remote cross site scripting attack.
This flaw exists because the application does not validate the 'reply'
variable upon submission to the 'post.php' script.

This could allow a user to create a specially crafted URL that would execute
arbitrary code in a user's browser within the trust relationship between the
browser and the server, leading to a loss of integrity.


Solution : Upgrade to Moodle 1.4 or newer

Risk factor : Medium