Detections
Analytics
Moodle < 1.4.3 Multiple Vulnerabilities
high Nessus Plugin ID 15639
Language:
Synopsis
The remote web server is hosting a PHP application that is affected by multiple vulnerabilities.Description
The remote host is running a version of the Moodle suite that is prior to version 1.4.3. It is, therefore, affected by a SQL injection vulnerability in the 'glossary' module due to a lack of user input sanitization.In addition, Moodle has also been reported to be affected by a directory traversal and a cross-site scripting flaw. However, Nessus has not explicitly tested for these issues.
Solution
Upgrade to Moodle 1.4.3 or later.See Also
Plugin Details
Severity: High
ID: 15639
File Name: moodle_sql_inject.nasl
Version: 1.23
Type: remote
Family: CGI abuses
Published: 11/6/2004
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.5
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:moodle:moodle
Required KB Items: www/PHP, installed_sw/Moodle
Exploit Available: true
Exploit Ease: No exploit is required
Patch Publication Date: 9/29/2004
Vulnerability Publication Date: 9/29/2004
Reference Information
CVE: CVE-2004-1424, CVE-2004-1425, CVE-2004-2232
CWE: 79