PT-2023-29739 · Gibbon · Gibbon
Christian Poeschl
·
Published
2023-11-13
·
Updated
2025-05-02
·
CVE-2023-45878
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GibbonEdu Gibbon versions 25.0.1 and before
Description
The issue allows for Arbitrary File Write due to the lack of authentication in the rubrics visualise saveAjax.php file. This file accepts parameters such as
img, path, and gibbonPersonID. The img parameter is expected to be a base64 encoded image, and if the path parameter is set, it is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is then base64 decoded and written to the defined file path, allowing for the creation of PHP files that permit Remote Code Execution without authentication.Recommendations
For versions 25.0.1 and before, as a temporary workaround, consider disabling the rubrics visualise saveAjax.php file until a patch is available. Restrict access to this file to minimize the risk of exploitation. Avoid using the
img, path, and gibbonPersonID parameters in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
RCE
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gibbon