CVE-2024-34000

What it actually does

Insufficient sanitization of ID numbers in the lesson overview report allows injection and persistent storage of malicious scripts that execute in other users' browsers.

Why it matters to the business

Educational institutions using Moodle face risk of unauthorized script execution that could lead to session hijacking, data theft, or unauthorized actions within the learning platform, though low exploit likelihood limits immediate operational disruption.

How an attack unfolds

An attacker with lesson-creation privileges supplies crafted ID values containing script payloads; the values are stored without proper escaping and later rendered unsanitized in the overview report, executing when viewed by teachers or administrators.

How to fix it

Upgrade Moodle to a version containing commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10, which adds proper sanitization of the ID numbers displayed in lesson reports.

How to confirm the fix worked

Confirm the patch commit is present in the deployed codebase; test by submitting script-containing IDs and verifying they are escaped or removed in generated reports.

Typical attack path

1. Obtain or create an account with lesson management rights
2. Insert malicious payloads into ID fields while building lessons
3. Trigger generation of the lesson overview report
4. Wait for a privileged user to view the report
5. Leverage executed script for cookie theft, privilege escalation, or further platform abuse

How to detect it

Review lesson overview reports and associated database entries for unexpected script tags or encoded payloads; examine web server and application logs around report access times for anomalous input patterns.

What your security team should do

• Apply the referenced commit or newer release across all Moodle instances
• Audit existing lesson content for anomalous ID values
• Monitor report-generation access logs for unusual patterns
• Enforce least-privilege access for lesson creation roles