CVE-2023-45878
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2023-45878 is a vulnerability affecting GibbonEdu Gibbon version 25.0.1 and earlier. It allows for Arbitrary File Write due to a lack of authentication in the rubrics_visualise_saveAjax.phps endpoint. This endpoint accepts the img, path, and gibbonPersonID parameters, with the img parameter expected to be a base64 encoded image. If the path parameter is provided, the defined path is used as the destination folder, combined with the absolute path of the installation directory. The content of the img parameter is then base64 decoded and written to the specified file path, enabling an attacker to create PHP files and execute remote code without authentication.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Gibbonedu Gibbon
Affected Vendors
- Gibbonedu
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions