Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Moodle Improper Control of Generation of Code (Code Injection) Vulnerability - CVE-2018-14630 - Vulnerability Database
Moodle

Moodle Improper Control of Generation of Code (Code Injection) Vulnerability - CVE-2018-14630

High
Reference: CVE-2018-14630
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2018-14630
Title: Moodle Improper Control of Generation of Code (Code Injection) Vulnerability
Overview:

moodle before versions 3.5.2 3.4.5 3.3.8 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 39drag and drop into text39 (ddwtos) type quiz questions it was possible to inject and execute PHP code from within the imported questions either intentionally or by importing questions from an untrusted source.