Description
A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | moodle | < 4.1.12, 4.2 – < 4.2.9, 4.3 – < 4.3.6, 4.4 – < 4.4.2 | 4.1.12 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | moodle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | moodle | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Moodle Remote Code Execution (CVE-2024-43425)
exploit/linux/http/moodle_rce
Exploit-DB 1
- Moodle 4.4.0 - Authenticated Remote Code Execution EDB-52350 · webapps · Jul 2, 2025
GitHub 5 repositories
-
RedTeamPentesting/moodle-rce-calculatedquestions ★ 19 · Aug 23, 2024
Scripts for Analysis of a RCE in Moodle Calculated Questions (CVE-2024-43425)
-
Snizi/Moodle-CVE-2024-43425-Exploit ★ 4 · Feb 7, 2025
-
kazuya256/Moodle-authenticated-RCE ★ 2 · Jul 13, 2025
🚀 Exploit for Moodle 4.4.0 Authenticated RCE (CVE-2024-43425) — run commands remotely ⚡
-
Tnot123/cve-2024-43425 ★ 0 · Oct 13, 2025
-
aninfosec/CVE-2024-43425-Poc ★ 0 · Jun 28, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Moodle - Remote Code Execution http/cves/2024/CVE-2024-43425.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | moodle/moodle | < 4.1.12 | 4.1.12 | GHSA-v6f4-v8h8-3c87 |
| Packagist | moodle/moodle | >= 4.2.0-beta, < 4.2.9 | 4.2.9 | GHSA-v6f4-v8h8-3c87 |
| Packagist | moodle/moodle | >= 4.3.0-beta, < 4.3.6 | 4.3.6 | GHSA-v6f4-v8h8-3c87 |
| Packagist | moodle/moodle | >= 4.4.0-beta, < 4.4.2 | 4.4.2 | GHSA-v6f4-v8h8-3c87 |
Advisories 1
- WID-SEC-2024-1877 Moodle: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 28, 2024
References
- RHBZ#2304253 issue-tracking
- https://moodle.org/mod/forum/discuss.php?d=461193