Danbardo

start

Danbardo

There is a persistent XSS in /course/modedit.php of Moodle 3.7.2 and prior which allows an attacker to inject harmful 
scripts into the page which are executed in the browser of any user enrolled in a class via the introeditor[text] 
parameter. This can also be done through the TinyMCE HTML editor itself.

With lecturer level access or above Moodle allows the addition of many different objects to the home page of a class. 
Many of these objects allow a HTML based description to be added via a web based HTML editor. While there is a client 
side sanitizer used, it can be very easily avoided by intercepting the HTTP request and adding a java script element to 
the introeditor[text] parameter. Once the java script has been injected, it is executed on page load for any user who 
accesses the page (including users with lower or higher level access). This could lead to very targeted denial of service 
attacks, ransom, injection of harmful scripts, the collection of user information and a basis for social engineerin