Miggo Logo

CVE-2016-5013: Moodle Does Not Escape Characters In Email Headers

5.4

CVSS Score
3.0

Basic Information

EPSS Score
0.57648%
Published
5/13/2022
Updated
9/12/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
moodle/moodlecomposer>= 3.0, <= 3.0.43.0.5
moodle/moodlecomposer>= 2.9, <= 2.9.62.9.7
moodle/moodlecomposer>= 2.8, <= 2.8.12
moodle/moodlecomposer>= 2.7, <= 2.7.142.7.15
moodle/moodlecomposer>= 3.1, < 3.1.13.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper escaping in email header construction. The commit diff shows critical changes to moodle_phpmailer.php's encodeHeader method, where special characters in 'phrase' context (like sender names) were not escaped with addcslashes. This allowed injection of CRLF sequences or additional email headers. The added test cases in text_test.php specifically verify escaping of quotes and backslashes in headers, confirming this was the attack vector. The CWE-74 classification and advisory description about header injection align perfectly with this code change.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In Moo*l* *.x *n* *.x, t*xt inj**tion **n o**ur in *m*il *****rs, pot*nti*lly l***in* to out*oun* sp*m.

Reasoning

T** vuln*r**ility st*ms *rom improp*r *s**pin* in *m*il *****r *onstru*tion. T** *ommit *i** s*ows *riti**l ***n**s to moo*l*_p*pm*il*r.p*p's *n*o*******r m*t*o*, w**r* sp**i*l ***r**t*rs in 'p*r*s*' *ont*xt (lik* s*n**r n*m*s) w*r* not *s**p** wit*