https://github.com/stackoverflowexcept1on/cve-2021-36393

Error-based blind SQL injection with bit-shifting approach for Moodle 3.10.4
https://github.com/stackoverflowexcept1on/cve-2021-36393

cve moodle sql-injection vulnerability

Last synced: 3 days ago
JSON representation

Error-based blind SQL injection with bit-shifting approach for Moodle 3.10.4

• Host: GitHub
• URL: https://github.com/stackoverflowexcept1on/cve-2021-36393
• Owner: StackOverflowExcept1on
• Created: 2023-10-27T17:13:55.000Z (about 1 year ago)
• Default Branch: master
• Last Pushed: 2023-12-29T14:12:50.000Z (11 months ago)
• Last Synced: 2023-12-29T15:26:56.587Z (11 months ago)
• Topics: cve, moodle, sql-injection, vulnerability
• Language: JavaScript
• Homepage:
• Size: 11.7 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
### CVE-2021-36393

Error-based blind SQL injection with bit-shifting approach for Moodle 3.10.4.

Allows an attacker to perform arbitrary database queries. For example, you can steal:

- test answers from the database

  Modify the [`script.js`](script.js) file and run it on route `/mod/quiz/attempt.php?attempt=...&cmid=...`

- user password hashes:

  ```sql

  (SELECT password FROM mdl_user WHERE id = 2 LIMIT 1)

  ```

- user sessions:

  ```sql

  (SELECT sid FROM mdl_sessions ORDER BY id DESC LIMIT 1)

  ```

### How to use it?

You must be logged in and enrolled in at least one course. The just copy the [`script.js`](script.js) code into your

browser console and run it on a website that has the vulnerable version of Moodle installed.

### How to check the installed version of Moodle?

```bash

DOMAIN="example.com"

curl -s https://$DOMAIN/lib/upgrade.txt | head

```