CVE-2015-1493

CVE-2015-1493 is a directory traversal vulnerability found in the min_get_slash_argument function within lib/configonlylib.php of Moodle versions through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3. This flaw allows authenticated attackers to read arbitrary files, such as PHP scripts, by injecting ".." (dot dot) sequences into the file parameter. The vulnerability has a CVSS score of 6.8, indicating a medium severity. It is exploitable remotely over the network with low attack complexity, requiring authentication (AV:N/AC:L/Au:S). The primary impact is a complete compromise of confidentiality (C:C), allowing unauthorized access to sensitive data, with no impact on integrity or availability. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei, or entries in ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention from researchers or the public.