VYPR
← All advisories
Moderate severityNVD Advisory· Published Jul 16, 2012· Updated Apr 29, 2026

CVE-2011-4280

CVE-2011-4280

Description

Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
>= 2.0, < 2.0.22.0.2

Affected products

3
  • Moodle/Moodle2 versions
    cpe:2.3:a:moodle:moodle:2.0.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:moodle:moodle:2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.0.1:*:*:*:*:*:*:*
  • Nimish Pachapurkar/Spike Phpcoverage
    cpe:2.3:a:nimish_pachapurkar:spike_phpcoverage:*:*:*:*:*:*:*:*

Patches

1
bd654f0ced8a

MDL-26237 code coverage - prevent execution of not used stuff

https://github.com/moodle/moodleEloy Lafuente (stronk7)Feb 2, 2011via ghsa
commit
3 files changed · +4 −0
  • lib/spikephpcoverage/readme_moodle.txt+2 −0 modified
    @@ -18,5 +18,7 @@ Our changes: /// Look for "moodle" in code
  * src/reporter/HtmlCoverageReporter.php, src/reporter/html/indexheader.html,
    src/reporter/html/header.html, src/reporter/html/footer.html - various xhtml fixes
  * removed deprecated "=& new"
+ * src/phpcoverage.remote.bottom.inc.php | => Prevent execution (not used and unsecure)
+   src/phpcoverage.remote.top.inc.php    |
 
 20090621 - Eloy Lafuente (stronk7): Original import of 0.8.2 release
  • lib/spikephpcoverage/src/phpcoverage.remote.bottom.inc.php+1 −0 modified
    @@ -1,4 +1,5 @@
 <?php
+    die(); // This (unsecure MDL-26237) stuff isn't used by moodle at all
 /*
  *  $Id$
  *
  • lib/spikephpcoverage/src/phpcoverage.remote.top.inc.php+1 −0 modified
    @@ -1,4 +1,5 @@
 <?php
+    die(); // This (unsecure MDL-26237) stuff isn't used by moodle at all
 /*
  *  $Id$
  *

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.