Moodle calculated-question RCE (CVE-2018-1133)

CVE-2018-1133 is a vulnerability in Moodle prior to version 3.5.0 that lets a user with a teacher role run arbitrary PHP code on the server. The flaw lives in the quiz component, specifically in "calculated" questions, where the teacher enters math formulas that Moodle evaluates with PHP's eval() function.

Moodle tries to sanitise those formulas with a validator, but the filter can be bypassed. Formulas accept placeholders like {x} that get substituted by values; by nesting them and combining them with PHP comments, you slip in code the validator doesn't catch but eval() still reaches. A typical payload:

/*{a*/`$_GET[0]`;//{x}}

The /*{a*/ block opens a comment that confuses the validator, the backticks ( `...` ) run the content as a system command, and $_GET[0] lets you pass the command through the URL. On previewing the question, eval() processes the formula and runs the code, giving remote execution: usually a reverse shell as the web server user (www-data).

searchsploit -m 46551
php 46551.php    # tweak the URL, teacher credentials and the course id

Practical requirements. You need an account with a teacher role and a course to create the quiz in; the automated exploit (46551.php) also needs the course ID, visible in the teacher's profile or in the course URL. Getting those credentials is the prior phase (on Teacher, a partial password leak plus one-character brute force).

How to detect it. The trace is in Moodle's own database: a calculated question whose formula contains PHP comments, backticks or $_GET/exec/system (/*{a*/ is the bypass signature), which no legitimate math formula carries. In the access log, the question preview (question/preview.php or the quiz editor) followed by requests with a 0=<command> parameter is the trigger. Host-side confirmation is the web process (www-data) spawning sh/bash as a child after that preview (auditd/Sysmon for Linux).

Defence. Upgrade Moodle to 3.5.0 or later (where formula evaluation no longer uses eval() unsafely), limit the teacher role to those who need it, and monitor question creation with suspicious content. After the RCE usually comes hunting for credentials in config.php and cracking the hashes from the database.