GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).
References
| Link | Resource |
|---|---|
| https://herolab.usd.de/security-advisories/usd-2023-0025/ | Exploit Third Party Advisory |
| https://herolab.usd.de/security-advisories/usd-2023-0025/ | Exploit Third Party Advisory |
Configurations
History
17 Nov 2023, 21:33
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://herolab.usd.de/security-advisories/usd-2023-0025/ - Exploit, Third Party Advisory | |
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Gibbonedu
Gibbonedu gibbon |
|
| CPE | cpe:2.3:a:gibbonedu:gibbon:*:*:*:*:*:*:*:* |
14 Nov 2023, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-14 06:15
Updated : 2025-01-08 17:15
NVD link : CVE-2023-45878
Mitre link : CVE-2023-45878
JSON object : View
Products Affected
gibbonedu
- gibbon
CWE