I'm working on a CTF's Moodle site. A bug for Moodle 3.10 was recently published (CVE-2021-21809) aka as (Moodle spellchecker plugin command execution vulnerability) which is remote code injection.
For exploiting the bug, we need to change an executable path. However, in almost all Moodle sites, we cannot edit executable paths from Admin GUI, because the site admin set option
in the config.php
I'm working on bypassing this prevention in order to exploit the bug. But I don't know how or where to start.
Do you have any idea for this?
For exploiting the bug, we need to change an executable path. However, in almost all Moodle sites, we cannot edit executable paths from Admin GUI, because the site admin set option
Code
$CFG->preventexecpath = true;I'm working on bypassing this prevention in order to exploit the bug. But I don't know how or where to start.
Do you have any idea for this?