CVE-2008-0123 describes a Cross-Site Scripting (XSS) vulnerability in the install.php script of Moodle versions prior to 1.8.4, specifically confirmed in 1.8.3. An attacker could inject arbitrary web script or HTML via the dbname parameter during the Moodle installation process. This vulnerability has a CVSS score of 4.3, indicating a medium severity. It requires medium attack complexity and no authentication, allowing an unauthenticated remote attacker to impact the integrity of the user's session by injecting malicious scripts. The issue is limited to the installation phase, mitigating its long-term impact. While not listed on the KEV catalog or Hot List, an exploit for this vulnerability is publicly available on ExploitDB. There is no evidence of active exploitation, and it has received no community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.8.3CPE matchmatch criteria | cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:P/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.