Framework Misconfiguration Analysis with RIPS

21 Aug 2018 by Nils Werner

Framework Misconfiguration

PHP frameworks such as Symfony, Laravel and CodeIgniter come with a variety of functions and components that make it easier for developers to build their application. However, various settings and configurations can have far-reaching consequences for security. Next to our unique and in-depth analysis for exploitable security vulnerabilities, RIPS is now also able to detect security weaknesses that stem from insecure configurations.

Read More ...

Evil Teacher: Code Injection in Moodle

12 Jun 2018 by Robin Peraglie

Code Injection Exploit in Moodle

Moodle is a widely-used open-source e-Learning software with more than 127 million users allowing teachers and students to digitally manage course activities and exchange learning material, often deployed by large universities. In this post we will examine the technical intrinsics of a critical vulnerability in the previous Moodle release detected by RIPS Code Analysis. It is located in the Quiz component of Moodle and can be successfully exploited through the teacher role in order to perform remote code execution. If you are running Moodle < 3.5.0 we highly recommend to update your instances to the newest version immediately.

Read More ...