CVE-2025-62401

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The assignment module (mod_assign) supports timed assignments: when the site enables time limits and a teacher sets one, a student must confirm a Begin assignment prompt, and the countdown starts from that moment.

An Improper Access Control vulnerability (CVE-2025-62401) has been identified in the assignment module of Moodle and IOMAD, which allows a student to bypass the time restriction on a timed assignment, potentially giving them more time than allowed to complete it. Moodle tracks this issue as MSA-25-0050 (MDL-75087).

Per MITRE CWE-285: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

This issue affects all versions of Moodle before 4.1.21, versions 4.2.0 through 4.4.10, versions 4.5.0 through 4.5.6, and versions 5.0.0 through 5.0.2, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (mod/assign)
• Affected versions: <4.1.21, >=4.2.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.1.21, 4.4.11, 4.5.7, 5.0.3
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Medium-severity vulnerability is found in the moodle/moodle package in all versions before 4.1.21, 4.2.0 through 4.4.10, 4.5.0 through 4.5.6, and 5.0.0 through 5.0.2 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

The Begin assignment confirmation only existed in the button that the submission action menu (classes/output/user_submission_actionmenu.php) draws on the assignment page. It linked to the same action=editsubmission URL as the ordinary edit button, and the server had no way to tell the two apart. The timer was recorded as a side effect of loading that URL, inside get_user_submission() in locallib.php, and only when a submission record already existed:

    $action = optional_param('action', '', PARAM_TEXT);
    if ($action == 'editsubmission') {
        if (empty($submission->timestarted) && $this->get_instance()->timelimit) {
            $submission->timestarted = time();
            $DB->update_record('assign_submission', $submission);
        }
    }
}

When no record existed yet, the same function created one without a start time. view_edit_submission_page() then rendered the submission form unconditionally, whether or not a timer was running. The action menu also decided whether to show the Begin assignment prompt from the individual submission alone, ignoring the start time of a team submission. Taken together, the time limit relied on the student following the intended page flow, and Moodle's advisory confirms a student could get around the restriction.

Only students who can submit to an assignment with a time limit are in a position to exploit this, and the result is more working time than the teacher allowed. It does not give access to other users' submissions or grades. Assignments without a time limit, and sites where time limits are disabled, are not affected.

The fix enforces the start of the timer on the server. view_edit_submission_page() now shows the Begin assignment confirmation instead of the form while a timed submission is new and has not started, so opening the edit URL directly no longer reaches the form. The confirmation link carries a begin=1 flag, and get_user_submission() and get_group_submission() start the timer only when that flag is present:

    $action = optional_param('action', '', PARAM_TEXT);
    if ($action == 'editsubmission') {
        $starttimer = optional_param('begin', 0, PARAM_INT);
        // Only start the timer if the user has clicked the 'Begin assignment' button.
        if (empty($submission->timestarted) && $this->get_instance()->timelimit && $starttimer) {
            $submission->timestarted = time();
            $DB->update_record('assign_submission', $submission);
        }
    }

The action menu now checks both the individual and the team submission through a new is_submission_started() helper before deciding whether to show the prompt.

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.1.21, 4.4.11, 4.5.7, 5.0.3, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Charles Fulton (finder)