CVE-2010-1619

Vulnerability

The fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), used in Moodle, contains a cross-site scripting (XSS) vulnerability. This issue affects Moodle versions 1.8.x before 1.8.12 and 1.9.x before 1.9.8 [1]. The vulnerability allows an attacker to bypass the intended HTML sanitization by providing crafted HTML entities that are not properly handled during the cleaning process [2].

Exploitation

An attacker can exploit this vulnerability by sending crafted HTML entities to any component in Moodle that processes user-supplied text through the KSES library. No special network position or authentication is required if the targeted component is accessible to unauthenticated users; however, in many contexts, the attacker may need to be a logged-in user with permission to submit content (e.g., forum posts, comments). The attack does not require user interaction beyond the victim viewing the crafted content [1].

Impact

Successful exploitation results in arbitrary web script or HTML injection into the context of the Moodle application. This can lead to session theft, credential harvesting, defacement, or other client-side attacks performed against other users who view the affected content. The attacker's code executes in the victim's browser within the security context of the vulnerable Moodle site [1].

Mitigation

Moodle fixed this vulnerability in versions 1.8.12 and 1.9.8 [1]. Administrators should upgrade to these or later releases. No workarounds have been published, and the issue is not listed in the Known Exploited Vulnerabilities Catalog. The Moodle project provides open-source downloads and documentation for upgrading [2].