-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.5.0, < 3.5.2 | 3.5.2 |
| moodle/moodle | composer | >= 3.4.0, < 3.4.5 | 3.4.5 |
| moodle/moodle | composer | >= 3.2.0, < 3.3.8 | 3.3.8 |
| moodle/moodle | composer | < 3.1.14 | 3.1.14 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the handling of legacy 'drag and drop into text' (ddwtos) question imports. The commit diff shows removal of code that unserialized feedback text from XML answers. The removed code path used 'unserialize(stripslashes($ans->feedback['text']))' on attacker-controlled input, which allowed crafted PHP objects to be injected. This matches the CWE-94 (Code Injection) description and the advisory's explanation about PHP code execution via unserialization. The function 'import_from_xml' in 'questiontype.php' was directly modified to eliminate this insecure deserialization, confirming it as the vulnerable entry point.