CVE-2018-7700

What it actually does

Cross-site request forgery vulnerability allows an attacker to supply a partcode parameter containing a runphp field with embedded PHP code to tag_test_action.php, resulting in arbitrary code execution on the server.

Why it matters to the business

Successful exploitation can lead to full server compromise, data theft, website defacement, or use as a foothold for further attacks; high exploit maturity increases urgency for any remaining unpatched instances despite the issue being public for years.

How an attack unfolds

An attacker prepares a crafted HTTP request embedding PHP code via the partcode parameter targeting tag_test_action.php, then tricks an authenticated administrator into triggering the request through a malicious link or page, causing the server to execute the supplied code.

How to fix it

Upgrade all instances to a patched release that removes the ability to inject executable code through the partcode parameter; apply vendor fixes such as the commits referenced for moodle/moodle (GIT) including b19d180a869d69c66d3f6c72c35ddc9c8dafb935 and 027b757f20c8e50d6fec2ef6f1ff2d85075690fc where applicable, and verify removal of the vulnerable code path.

How to confirm the fix worked

Confirm the application version matches a fixed release, review the tag_test_action.php source to ensure runphp execution is disabled or properly sanitized, and perform authenticated testing to verify CSRF protections are in place.

Typical attack path

1. Identify an authenticated user with access to the vulnerable endpoint
2. Craft a CSRF payload containing PHP code in the runphp field of the partcode parameter
3. Deliver the payload via email, website, or other social engineering vector
4. Victim interaction causes the server to process and execute the attacker-supplied PHP

How to detect it

Review web server and application logs for unexpected POST requests to tag_test_action.php containing partcode with runphp references; inspect for PHP code patterns in request parameters from non-trusted sources and correlate with administrator session activity.

• POST requests to /tag_test_action.php containing partcode and runphp
• PHP code snippets such as <?php or eval( in partcode parameter values
• Unexpected file modifications or new PHP files created shortly after requests to tag_test_action.php

What your security team should do

• Immediately inventory all deployments of the affected application and prioritize patching based on exposure
• Implement web application firewall rules to block requests containing runphp or executable code patterns in partcode
• Enforce CSRF tokens on all state-changing endpoints and require re-authentication for sensitive actions
• Monitor for any post-patch indicators of prior compromise given the weaponized exploit maturity