-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability arises from the handling of the 'returnurl' parameter. In the vulnerable versions, cohort/upload_form.php's cohort_upload_form::definition() function explicitly added a hidden 'returnurl' form field (with PARAM_URL type) that accepted user-controlled input. This parameter was then passed to cohort/upload.php, where it was used to construct a redirect URL without proper validation. The PARAM_URL type alone does not enforce internal URL restrictions, allowing external redirects. The patch removed this field entirely, confirming its role in the vulnerability. While upload.php's parameter retrieval (optional_param('returnurl')) was part of the chain, the root cause lies in the form's exposure of this unvalidated parameter.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.6.0, <= 3.6.3 | 3.6.4 |
| moodle/moodle | composer | >= 3.5.0, <= 3.5.5 | 3.5.6 |
| moodle/moodle | composer | >= 3.4.0, <= 3.4.8 | 3.4.9 |
| moodle/moodle | composer | <= 3.1.17 | 3.1.18 |
Ongoing coverage of React2Shell