CVE-2018-1133

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	Moodle 3.x unknown	Moodle 3.x unknown

References

http://www.securityfocus.com/bid/104307Third Party Advisory, VDB Entry
https://moodle.org/mod/forum/discuss.php?d=371199Patch, Vendor Advisory
https://www.exploit-db.com/exploits/46551/Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/104307Third Party Advisory, VDB Entry
https://moodle.org/mod/forum/discuss.php?d=371199Patch, Vendor Advisory
https://www.exploit-db.com/exploits/46551/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: May 25, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-113304.8An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly res CVE-2018-113319.8An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in CVE-2018-113324.8Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 al CVE-2018-113347.8Windscribe 1.81 creates a named pipe with a NULL DACL that allows Everyone users to gain privileges or cause a denial of service via \\.\pip CVE-2018-113357.5GVToken Genesis Vision (GVT) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to CVE-2018-113387.5Intuit Lacerte 2017 for Windows in a client/server environment transfers the entire customer list in cleartext over SMB, which allows attack CVE-2018-113396.1An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.CVE-2018-11346.5An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle fil CVE-2018-113407.2An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a CVE-2018-113417.2Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parame CVE-2018-113424.3A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a fil CVE-2018-113435.4A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows attackers to store cross