A critical code injection vulnerability in Moodle allows authenticated attackers to execute arbitrary code, potentially leading to a full system compromise.

This is a code injection flaw (CWE-94) occurring within the Moodle restore interface. The vulnerability requires the attacker to have authenticated access and allows for server-side execution of arbitrary code due to inadequate input validation in core restore routines.

The ability to execute arbitrary code on the Moodle server constitutes a total compromise of the application. This vulnerability poses a severe risk to data confidentiality, integrity, and availability, as an attacker could extract sensitive user data, modify course content, or gain further persistence within the network. The CVSS score of 8.8 reflects the high severity of this flaw despite the requirement for authenticated access.

Immediate Action: Update Moodle to the patched versions: 5.1.1, 5.0.4, 4.5.8, or 4.4.12, depending on your current deployment branch.

Proactive Monitoring: Review system and application logs for unusual activity originating from the restore interface or unexpected process execution spawned by the web server user.

Compensating Controls: Restrict access to administrative and course restoration functions to trusted users only, and implement strict egress filtering on the Moodle server to prevent the establishment of remote command and control connections.

Public Exploit Available: No

Given the potential for full application compromise, administrators must prioritize the update to the latest Moodle version. Do not delay patching, as the ability to execute code on the host server provides an attacker with significant leverage to escalate privileges or exfiltrate sensitive institutional data.