CVE-2015-3174 in Moodle
Summary
by MITRE
mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradebook feedback during manual quiz grading.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/19/2022
The vulnerability described in CVE-2015-3174 affects the Moodle learning management system and represents a critical cross-site scripting weakness that impacts multiple versions of the platform. This flaw exists within the quiz module's database access file at mod/quiz/db/access.php, where the system fails to properly set the RISK_XSS bit for users with grading privileges. The issue creates a dangerous condition where authenticated users who possess grading capabilities can manipulate the gradebook feedback functionality to inject malicious scripts, thereby enabling persistent XSS attacks against other users within the same Moodle environment.
The technical nature of this vulnerability stems from inadequate input validation and output sanitization within the quiz grading interface. When grader users submit feedback through the manual quiz grading process, the system does not properly escape or validate the input data before storing and rendering it in the gradebook. This oversight allows attackers to embed malicious JavaScript code within the feedback text, which then executes whenever other users view the gradebook entries. The vulnerability specifically targets the RISK_XSS flag that should be set for grading users, indicating their elevated privileges and the associated security risks they pose if their input is not properly sanitized.
The operational impact of CVE-2015-3174 extends beyond simple script execution, as it provides attackers with a persistent vector for more sophisticated attacks. Once an attacker successfully injects malicious code through the gradebook feedback system, they can potentially steal session cookies, redirect users to malicious sites, or perform actions on behalf of other users within the Moodle platform. This vulnerability particularly affects educational institutions that rely heavily on Moodle for their online learning environments, as it can compromise the security of thousands of users including students, instructors, and administrators who interact with the quiz grading functionality. The attack requires only authentication to the system, making it particularly dangerous as it can be exploited by any user with grading permissions rather than requiring special privileged access.
Security mitigations for this vulnerability involve implementing proper input sanitization and output encoding mechanisms within the Moodle quiz module. System administrators should immediately upgrade to the patched versions of Moodle that address this issue, specifically versions 2.5.9, 2.6.11, 2.7.8, and 2.8.6 respectively. The fix requires ensuring that all user-supplied feedback data is properly escaped before being stored in the database and rendered to other users. This aligns with the CWE-79 principle of preventing cross-site scripting by implementing proper input validation and output encoding. Organizations should also consider implementing additional security measures such as content security policies and regular security audits of their Moodle installations. The ATT&CK framework categorizes this vulnerability under the T1059.007 technique for script injection, emphasizing the need for proper input validation and the importance of protecting privileged user interfaces from malicious input manipulation.