Improper Handling of Control Characters in PHP Spellchecker for Moodle
CVE-2012-6112

Currently unrated

Key Information:

Vendor

Tinymce

Status
Spellchecker PHP
Vendor
CVE Published:
27 January 2013

What is CVE-2012-6112?

The PHP Spellchecker (Google Spellchecker) addon, prior to version 2.0.6.1, contains a flaw in the 'classes/GoogleSpell.php' component. This vulnerability allows remote attackers to exploit the inadequacy in control character handling, potentially leading to the execution of arbitrary outbound HTTP requests triggered by specially crafted strings. This flaw affects several versions of Moodle, making it crucial for users to update to secure versions to mitigate the risk of exploitation.

References

https://github.com/tinymce/tinymce_spellchecker_php/commi...
x_refsource_CONFIRM
http://www.tinymce.com/forum/viewtopic.php?id=30036
x_refsource_CONFIRM
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=...
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.