Detections
Analytics
Moodle 'PHPCOVERAGE_HOME' Parameter XSS
medium Nessus Plugin ID 51852
Language:
Synopsis
The remote web server hosts a PHP script that is affected by a cross-site vulnerability.Description
The version of Moodle installed on the remote host does not sanitize user-supplied input to the 'PHPCOVERAGE_HOME' parameter of the 'lib/spikephpcoverage/src/phpcoverage.remote.top.inc.php' script before using it to generate dynamic HTML.An attacker can leverage this issue to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.
Solution
Upgrade to Moodle 2.0.2 or later.See Also
Plugin Details
Severity: Medium
ID: 51852
File Name: moodle_phpcoverage_home_xss.nasl
Version: 1.20
Type: remote
Family: CGI abuses : XSS
Published: 2/2/2011
Updated: 6/6/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Vulnerability Information
CPE: cpe:/a:moodle:moodle
Required KB Items: www/PHP, installed_sw/Moodle
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/2/2011
Vulnerability Publication Date: 1/27/2011
Reference Information
BID: 46085