CVE-2017-5945 in PoodLL Filter Plugin
Summary
by MITRE
An issue was discovered in the PoodLL Filter plugin through 3.0.20 for Moodle. The vulnerability exists due to insufficient filtration of user-supplied data in the "poodll_audio_url" HTTP GET parameter passed to the "filter_poodll_moodle32_2016112802/poodll/mp3recorderskins/brazil/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/12/2022
The vulnerability identified as CVE-2017-5945 affects the PoodLL Filter plugin version 3.0.20 and earlier implementations within the Moodle learning management system. This represents a classic cross-site scripting vulnerability that arises from inadequate input validation and sanitization within the plugin's processing logic. The flaw specifically manifests in the handling of the "poodll_audio_url" HTTP GET parameter, which is processed through the designated endpoint path that includes the mp3recorderskins/brazil/index.php file structure.
The technical implementation of this vulnerability stems from the plugin's failure to properly sanitize user-supplied input before incorporating it into dynamically generated web content. When the "poodll_audio_url" parameter is passed through the HTTP GET request to the specified URL, the plugin directly embeds this unvalidated data into the page output without appropriate HTML escaping or context-aware sanitization measures. This allows an attacker to inject malicious script code that executes within the browser context of legitimate users who access the affected page, creating a persistent cross-site scripting vector.
The operational impact of this vulnerability extends beyond simple script injection, as it provides attackers with the capability to execute arbitrary code within the browser environment of authenticated users. This could enable attackers to steal session cookies, perform unauthorized actions on behalf of users, redirect victims to malicious sites, or even establish persistent backdoors through more sophisticated attack vectors. The vulnerability affects the entire Moodle ecosystem where the PoodLL plugin is installed, potentially compromising multiple user sessions and undermining the security posture of educational institutions relying on the platform.
Security practitioners should note that this vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws in web applications, and demonstrates the importance of implementing proper input validation and output encoding as fundamental security controls. The ATT&CK framework categorizes this as a code injection technique under the T1059 category, where attackers exploit application vulnerabilities to execute malicious code. Organizations should prioritize immediate patching of the PoodLL plugin to version 3.0.21 or later, which includes the necessary input sanitization fixes. Additionally, implementing proper HTTP headers including Content Security Policy can provide defense-in-depth measures to mitigate the impact of such vulnerabilities. Network monitoring should also be enhanced to detect suspicious GET parameter patterns that may indicate exploitation attempts.