Moodle filter_jmol - LFI

The Jmol/JSmol plugin is used to display chemical structures in Moodle using Java and JavaScript.The plugin uses a PHP server-side proxy to bypass client-side security constraints while loading third-party resources.This PHP proxy script calls the function file_get_contents() on unvalidated user input.

Impact

In the default PHP setup, this makes Moodle instances with this plugin vulnerable to directory traversal and server-side request forgery. If PHP’s “expect” wrapper is enabled, this may also result in remote code execution vulnerability.

Mitigation / Precaution

In order to patch this vulnerability, we recommend you to update the Jmol plugin to the latest version.

Written by

Sooraj V Nair

Cyber Security Engineer

Sooraj was probably the kid who opened up a remote control just to see what was inside, then had to figure out how to put it back together before anyone noticed. That curiosity eventually found its way into cybersecurity, where breaking things is actually part of the job description. Today, he explores vulnerabilities, analysis threats, and helps build safer digital spaces. His favourite question remains the same: “What happens if I try this?”