Moodle Persistent Cross-Site Scripting Vulnerability in Calendar Event Subtitles

A persistent cross-site scripting vulnerability has been identified in Moodle version 3.10.3. This issue resides in the calendar event subtitle field, where attackers can inject malicious scripts. By crafting a calendar event with harmful JavaScript in the subtitle track label, attackers can execute arbitrary code when users view the event.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, where injected scripts are executed when the event is viewed.

Reproduction

To reproduce this vulnerability, create a calendar event in Moodle 3.10.3. In the event subtitle track label, insert JavaScript code, such as an image tag with an 'onerror' event or a base64-encoded script. After saving the event, the injected script will execute when the event is viewed.