CVE-2015-2273 in Moodle
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a crafted quiz response.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/19/2022
The CVE-2015-2273 vulnerability represents a critical cross-site scripting flaw within the Moodle learning management system that affects multiple versions including 2.5.9 and earlier, 2.6.x versions before 2.6.9, 2.7.x versions before 2.7.6, and 2.8.x versions before 2.8.4. This vulnerability exists within the statistics reporting module specifically in the statistics_question_table.php file, which is responsible for displaying quiz question statistics to users. The flaw allows authenticated users with the student role to inject malicious web scripts or HTML code into the system, creating a significant security risk for educational institutions relying on Moodle for their online learning platforms.
The technical exploitation of this vulnerability occurs through the manipulation of quiz response data that gets processed and displayed in the statistics reporting interface. When students submit quiz responses, the system fails to properly sanitize or escape user input before rendering it in the HTML output of the statistics table. This improper handling of user-supplied data creates an XSS vector that enables attackers to execute arbitrary scripts in the context of other users' browsers. The vulnerability is particularly concerning because it requires only the student role to exploit, making it accessible to anyone with basic access to a Moodle course rather than requiring administrative privileges or more sophisticated attack vectors.
From an operational impact perspective, this vulnerability exposes Moodle installations to several potential security threats including session hijacking, credential theft, and unauthorized access to sensitive educational data. The attacker could potentially steal session cookies from authenticated users, allowing them to impersonate students or even instructors within the system. Additionally, the malicious scripts could be used to redirect users to phishing sites, steal personal information, or manipulate quiz results and grades. Given that Moodle is widely used in educational institutions, the potential for widespread impact is significant, as attackers could compromise multiple user accounts across different courses and departments.
The vulnerability aligns with CWE-79, which describes Cross-site Scripting flaws, and maps to several ATT&CK techniques including T1566 for credential access through social engineering and T1071 for application layer protocol usage. Organizations should implement immediate mitigations including applying the official security patches released by Moodle for the affected versions, implementing input validation and output escaping mechanisms in the statistics reporting module, and conducting thorough security reviews of all user-supplied data handling processes. Network-based mitigations such as web application firewalls and content security policies should also be deployed to provide additional layers of protection against exploitation attempts. Regular security audits and user access reviews are essential to prevent unauthorized individuals from gaining the student role and exploiting this vulnerability in production environments.