Description

Moodle before 1.6.2, when the configuration lacks (1) algebra or (2) tex filters, allows remote authenticated users to write LaTeX or MimeTeX output files to the top level of the dataroot directory via (a) filter/algebra/pix.php or (b) filter/tex/pix.php.

Remediation

References

CVE-2006-4942

Related Vulnerabilities

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-4828)

PHP Other Vulnerability (CVE-2006-4485)

WordPress Plugin Qwizcards-online quizzes and flashcards Cross-Site Scripting (3.36)

Oracle Application Server Other Vulnerability (CVE-2002-2153)

WordPress Plugin 5gig Concerts Unspecified Vulnerability (1.0)

Severity

Medium

Classification

CVE-2006-4942

Tags

Missing Update Known Vulnerabilities