The only right he has is that of a student, with the default permissions and preventions. The "course delete mod" and "course editsection" activity was on his own activity report, as a student. Moodle version: 1.8.

Thanks HP

The theory might be good Edwin, but surely that presupposes the site being set up in such a way as to allow the student/hacker access to the php/database in the first place? Surely most sites should be set up in such a way as to prevent that happening in the first place?

If you give a hacker access to your core code and database then ANY site is going to be hackable on that basis! The key is whether or not a site is accessible with a modicum of decent security put in place, I would have thought!

Richard

Assuming they can get access to the database, which is a big assumption, if the site has a somewhat competent admin.  Of course, if you already had access to the database, why bother logging in, when you can just make changes directly?

Anyways, to start with, MD5 is not encryption; it is a hash.  Encryption is reversible, if you know the key, while a hash is not (aside from brute force).  And yes, there are known weaknesses in MD5 (e.g., it is too fast).  Future versions of Moodle will use a different hash (if you have a recent enough version of PHP), which will not be as succeptible to the same issues as MD5.

Hi,

can u teach and explain some step . I have one assignment to do for penetration report for hack the moodle. I have one moodle under the VMware. 

are you have interesting to see information..  

tks