What is CVE-2013-5674?

CVE-2013-5674 is a vulnerability in Moodle, classified under Code Injection. Published 2013-09-16.

Is CVE-2013-5674 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Moodle

CVE-2013-5674

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid parameter.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.021 (79.8th percentile) — read the EPSS interpretation.

Affected products

Moodle — versions 2.5.0, 2.5.1
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

epinna/researches

References

cve@mitre.org (x_refsource_CONFIRM, Patch)
cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2013-5674?: CVE-2013-5674 is a vulnerability in Moodle, classified under Code Injection. Published 2013-09-16.
Is CVE-2013-5674 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.