Moodle LMS Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Moodle LMS version 4.0. This vulnerability allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter in the course search page. The injected JavaScript can execute arbitrary scripts in the context of the user's browser, potentially leading to the theft of session cookies.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the course search page and enter a payload into the search field. The injected script will be executed in the user's browser.