Miggo Logo
Miggo Vulnerability Database
→
CVE-2015-0213

CVE-2015-0213: Moodle multiple cross-site request forgery (CSRF) vulnerabilities

6.8

CVSS Score

Basic Information

CVE ID
CVE-2015-0213
GHSA ID
GHSA-hhq7-jf2p-hw9c
EPSS Score
0.32891%
CWE
CWE-352
Published
5/13/2022
Updated
1/25/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
AV:N/AC:M/Au:N/C:P/I:P/A:P
Package NameEcosystemVulnerable VersionsFirst Patched Version
moodle/moodlecomposer< 2.6.72.6.7
moodle/moodlecomposer>= 2.7.0, < 2.7.42.7.4
moodle/moodlecomposer>= 2.8.0, < 2.8.22.8.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing CSRF protections in two key areas: 1) The PHP action handlers in editcategories.php didn't call require_sesskey() before executing state-changing operations (edit/delete/add categories). 2) The HTML form in editcategories.html didn't include a sesskey parameter in its submission. The patch added both sesskey hidden fields in the form and require_sesskey() checks in the PHP logic, confirming these were the vulnerable points. CSRF vulnerabilities manifest when state-changing actions lack token validation, which matches the pre-patch behavior observed in these components.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Multipl* *ross-sit* r*qu*st *or**ry (*SR*) vuln*r**iliti*s in (*) **it**t**ori*s.*tml *n* (*) **it**t**ori*s.p*p in t** *loss*ry mo*ul* in Moo*l* t*rou** *.*.*, *.*.x ***or* *.*.*, *.*.x ***or* *.*.*, *n* *.*.x ***or* *.*.* *llow r*mot* *tt**k*rs to

Reasoning

T** vuln*r**ility st*ms *rom missin* *SR* prot**tions in two k*y *r**s: *) T** P*P **tion **n*l*rs in **it**t**ori*s.p*p *i*n't **ll r*quir*_s*ssk*y() ***or* *x**utin* st*t*-***n*in* op*r*tions (**it/**l*t*/*** **t**ori*s). *) T** *TML *orm in **it**