The vulnerability arises from two main issues. First, the lti_view function in mod/lti/locallib.php constructed return URLs without a session key, making them vulnerable to manipulation. Second, mod/lti/return.php processed the 'lti_errormsg' parameter using PARAM_RAW (which allows unvalidated input) and lacked a session key check (require_sesskey()). However, since the return.php code is procedural and not encapsulated in a named function, only lti_view is listed as a vulnerable function with high confidence. The patch addressed these by adding sesskey validation, using PARAM_TEXT for input sanitization, and proper output escaping with p().
Miggo AI