Description
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
Remediation
References
Related Vulnerabilities
Dolibarr Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2022-0819)
PHP Numeric Errors Vulnerability (CVE-2011-1466)
WordPress Plugin Login with Cognito Cross-Site Scripting (1.4.3)
PrestaShop URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2020-5270)