System	Score	Found at
generic_textual	MODERATE

Reference id	Reference type	URL
		http://packetstormsecurity.com/files/164479/Moodle-Authenticated-Spelling-Binary-Remote-Code-Execution.html
		https://github.com/moodle/moodle
CVE-2013-3630		https://nvd.nist.gov/vuln/detail/CVE-2013-3630
seven-foss-disclosures-part-one	Other	https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-foss-disclosures-part-one
seven-tricks-and-treats	Other	https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats

Data source	Metasploit
Description	Moodle allows an authenticated user to define spellcheck settings via the web interface. The user can update the spellcheck mechanism to point to a system-installed aspell binary. By updating the path for the spellchecker to an arbitrary command, an attacker can run arbitrary commands in the context of the web application upon spellchecking requests. This module also allows an attacker to leverage another privilege escalation vuln. Using the referenced XSS vuln, an unprivileged authenticated user can steal an admin sesskey and use this to escalate privileges to that of an admin, allowing the module to pop a shell as a previously unprivileged authenticated user. This module was tested against Moodle version 2.5.2 and 2.2.3.
Note	Stability: - crash-safe Reliability: - repeatable-session SideEffects: - config-changes - ioc-in-logs
Ransomware campaign use	Unknown
Source publication date	Oct. 30, 2013
Platform	Linux,Unix
Source URL	https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/moodle_spelling_binary_rce.rb

Data source	Exploit-DB
Date added	Oct. 31, 2013
Description	Moodle - Remote Command Execution (Metasploit)
Ransomware campaign use	Known
Source publication date	Oct. 31, 2013
Exploit type	remote
Platform	linux
Source update date	Oct. 31, 2013

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.