Detections
Analytics
Moodle 'lib/kses.php' 'kses_bad_protocol_once' Function Arbitrary PHP Code Execution
high Nessus Plugin ID 34095
Language:
Synopsis
The remote web server contains a PHP application that allows remote execution of arbitrary code.Description
The version of Moodle on the remote host includes a version of the KSES HTML filtering library that does not safely call 'preg_replace()' in the function 'kses_bad_protocol_once()' in 'lib/kses.php'. An unauthenticated, remote attacker can leverage this issue to inject arbitrary PHP code that will be executed subject to the privileges of the web server user id.Note that there are also reportedly several cross-site scripting and HTML filtering bypass vulnerabilities in the version of the KSES library in use, although Nessus has not explicitly tested for them.
Solution
Upgrade to Moodle 1.8.5, 1.9, or any recent nightly 1.7.x or 1.6.x build.See Also
Plugin Details
Severity: High
ID: 34095
File Name: moodle_kses_code_exec.nasl
Version: 1.24
Type: remote
Family: CGI abuses
Published: 9/5/2008
Updated: 6/6/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Vulnerability Information
CPE: cpe:/a:moodle:moodle
Required KB Items: www/PHP, installed_sw/Moodle
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Exploited by Nessus: true
Exploitable With
Elliot (Moodle <= 1.8.4 RCE)
Reference Information
BID: 28599