Cross-site request forgery (CSRF) vulnerability in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile settings and gain privileges as other users via a link or IMG tag to the user edit profile page.

Several remote vulnerabilities have been discovered in Moodle, an online course management system. The following issues are addressed in this update, ranging from cross site scripting to remote code execution.

Various cross site scripting issues in the Moodle codebase (CVE-2008-3326, CVE-2008-3325, CVE-2007-3555, CVE-2008-5432, MSA-08-0021, MDL-8849, MDL-12793, MDL-11414, MDL-14806, MDL-10276).

Various cross site request forgery issues in the Moodle codebase (CVE-2008-3325, MSA-08-0023).

Privilege escalation bugs in the Moodle codebase (MSA-08-0001, MDL-7755).

SQL injection issue in the hotpot module (MSA-08-0010).

An embedded copy of Smarty had several vulnerabilities (CVE-2008-4811, CVE-2008-4810 ). An embedded copy of Snoopy was vulnerable to cross site scripting (CVE-2008-4796 ). An embedded copy of Kses was vulnerable to cross site scripting (CVE-2008-1502 ).

Moodle was prone to CSRF (CVE-2008-3325) / XSS (CVE-2008-3326) flaws which could potentially be exploited to compromise arbitrary accounts.

ID	Name	Product	Family	Type	Severity
35254	Debian DSA-1691-1 : moodle - several vulnerabilities	Nessus	Debian Local Security Checks	Local	critical
33837	openSUSE 10 Security Update : moodle (moodle-5487)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2008-3325

high

Tenable Plugins

critical

medium