Hello,
I have a question regarding a security announcement, see here the security announcement
They say that this problem only affects sites that leave "$CFG-> smtphosts" empty.
I
would like to know if the sites that did not specify this parameter
neither in "config.php" nor in the configuration page of the email are
also affected by this problem
Thank you in advance for your answers
yes - but only site-admins with the ability to modify the noreply address are able to exploit this.
I'd just like to expand on something Marina said: "Also when we say that code will be executed on the server keep in mind that the user executing it will be the web user and hopefully the server is set up properly and this user can not do too much harm to the server."
This is playing down the risk a little in my opinion.
If an attacker can execute code as the web server user, the first code they usually execute will create a reverse shell to another machine the attacker controls. As the name suggests this creates a connection initiated from the web server to an address of the attackers choosing, and gives an interactive shell. The fact that the apache/httpd user cannot usually login via the shell has no impact on this. The connection is initiated from the server it will often bypass firewalls and other protections unless they're specifically setup with this in mind (and even then they can often be bypassed by using allowed ports).
Using this shell the attacker can freely enumerate the contents of the server itself to find privilege escalation vulnerabilities, upload/download to any location the web server user can write to (including /tmp and moodledata) and then exploit local vulnerabilities - usually for the purpose of privilege escalation to the root account.
Thank you all for these answers it is now clearer for me
