CVE-2024-43425

Moodle: remote code execution via calculated question types

A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.

Affected

moodle

CVSS v4.0 GitHub

7.2 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

CVSS v3.1 NVD

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

87.54% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical

Published

2024-11-07

Proof-of-concept exploits (6)

• Snizi/Moodle-CVE-2024-43425-Exploit4★ · 2025-02-07
• aayush256-sys/Moodle-authenticated-RCE2★ · 2025-08-24
• aninfosec/CVE-2024-43425-Poc0★ · 2025-06-28
• kazuya256/Moodle-authenticated-RCE2★ · 2025-08-24
• sharknet56/MALW1★ · 2025-12-24
• vuductruong12/KTLHPM0★ · 2025-11-27

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-43425.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/moodle_rce.rb

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52350

Security advisories

• https://moodle.org/mod/forum/discuss.php?d=461193
• advisories/GHSA-v6f4-v8h8-3c87

References

• CVE Record
• NVD entry

Related

• CVE-2019-10945
• CVE-2026-18963
• CVE-2025-29927
• CVE-2025-1094
• CVE-2025-1974
• CVE-2025-32463