CVE-2013-5674

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-09-16 · updated 2026-06-16
Weakness: CWE-94

Description

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid parameter.

Affected products

Moodle: 2.5.0, 2.5.1

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40924
https://moodle.org/mod/forum/discuss.php?d=238397
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40924
https://moodle.org/mod/forum/discuss.php?d=238397

Get alerted when CVE-2013-5674 or the next vulnerability affects your stack