CVE-2015-3275: Moodle multiple cross-site scripting (XSS) vulnerabilities

Background

Moodle is an open-source learning management system (LMS) used by educational institutions and organizations worldwide. It provides a platform for creating and delivering online courses, managing student enrollment, and facilitating communication between teachers and students. Moodle is written in PHP and utilizes a modular architecture, allowing for the integration of various plugins and modules to extend its functionality. However, multiple cross-site scripting (XSS) vulnerabilities have been identified in the SCORM module of Moodle versions 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1.

Vulnerability Detail

The identified XSS vulnerabilities in the SCORM module of Moodle allow remote attackers to inject arbitrary web script or HTML by exploiting a flaw in the handling of organization names. Specifically, the vulnerabilities exist in the 'player.php' and 'prereqs.php' files of the SCORM module. An attacker can craft a malicious organization name and submit it to these files, leading to the execution of the injected script or HTML in the context of the affected Moodle instance. This can potentially result in unauthorized access, data theft, or other malicious activities.

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by applying input validation and sanitization techniques to the organization name input fields in the 'player.php' and 'prereqs.php' files. This can help prevent the execution of malicious scripts or HTML injected through these fields. Here is an example of how input validation can be implemented in PHP:

$organizationName = $_POST['organization_name'];

// Validate and sanitize the input
if (!empty($organizationName)) {
    $sanitizedOrganizationName = htmlspecialchars($organizationName, ENT_QUOTES, 'UTF-8');
    // Use the sanitized value in further processing
}

It is important to note that this workaround is not a permanent solution and should be followed by upgrading to the latest patched version as soon as possible.

Conclusion

The identified XSS vulnerabilities in Moodle's SCORM module pose a moderate risk to affected installations. Upgrading to the latest patched versions of Moodle is the recommended solution to address these vulnerabilities. In the meantime, implementing input validation and sanitization techniques can provide a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for moodle/moodle →

FAQ