PT-2023-29739 · Gibbon · Gibbon
Christian Poeschl
·
Publicado
2023-11-13
·
Atualizado
2025-05-02
·
CVE-2023-45878
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GibbonEdu Gibbon versions 25.0.1 and before
Description
The issue allows for Arbitrary File Write due to the lack of authentication in the rubrics visualise saveAjax.php file. This file accepts parameters such as
img, path, and gibbonPersonID. The img parameter is expected to be a base64 encoded image, and if the path parameter is set, it is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is then base64 decoded and written to the defined file path, allowing for the creation of PHP files that permit Remote Code Execution without authentication.Recommendations
For versions 25.0.1 and before, as a temporary workaround, consider disabling the rubrics visualise saveAjax.php file until a patch is available. Restrict access to this file to minimize the risk of exploitation. Avoid using the
img, path, and gibbonPersonID parameters in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
RCE
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Gibbon