Description
VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jcrodriguez-dis moodle-mod_vpl
Default version status: unaffected
0 to < 5.0.0affected
References
- https://github.com/jcrodriguez-dis/moodle-mod_vpl/commit/5dd7fe00df2816b692f8ea262c6fa8cdee0b26b7 ↗
- https://github.com/jcrodriguez-dis/moodle-mod_vpl/releases/tag/V5.0.0 ↗
- https://github.com/jcrodriguez-dis/moodle-mod_vpl/blob/V4.5.0/similarity/diff.class.php#L412-L419 ↗
- https://www.vulncheck.com/advisories/vpl-for-moodle-before-5.0.0-reflected-xss-via-similarity-diff-php-filename ↗