EUVD-2025-18971
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4Description
A path traversal vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the query parameter in jsmol.php. The script directly passes user input to the file_get_contents() function without proper validation, allowing attackers to read arbitrary files from the server's filesystem by crafting a malicious query value. This vulnerability can be exploited without authentication and may expose sensitive configuration data, including database credentials. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
Analysis
The Moodle LMS Jmol plugin version 6.1 and earlier contains a path traversal vulnerability in jsmol.php. The query parameter is passed directly to file_get_contents() without validation, allowing unauthenticated attackers to read arbitrary files from the Moodle server including configuration files with database credentials.
Technical Context
The jsmol.php script passes the query parameter directly to file_get_contents() without path sanitization. An attacker can traverse directories to read any file accessible to the web server process, including Moodle's config.php which contains database credentials, secret keys, and LDAP configuration.
Affected Products
['Moodle Jmol plugin <= 6.1']
Remediation
Remove or update the Jmol plugin. Implement path validation in jsmol.php. Rotate database credentials. Review Moodle access logs for path traversal attempts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today