CVE-2013-5674: Code Injection
badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid parameter.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5674?
CVE-2013-5674 is classified as a medium severity vulnerability due to its potential for PHP object injection attacks.
How do I fix CVE-2013-5674?
To fix CVE-2013-5674, upgrade Moodle to version 2.5.2 or later which has addressed this vulnerability.
What versions of Moodle are affected by CVE-2013-5674?
CVE-2013-5674 affects Moodle versions 2.5.0 and 2.5.1.
What type of attack can CVE-2013-5674 facilitate?
CVE-2013-5674 can facilitate remote PHP object injection attacks due to improper handling of unserialized objects.
Is user data at risk due to CVE-2013-5674?
Yes, CVE-2013-5674 poses a risk to user data as attackers may exploit it to overwrite user-related values.