CVE-2023-45881

Summary

CVE-2023-45881 is a vulnerability affecting GibbonEdu Gibbon's Planner module before version 25.0.1. This issue enables file uploads via the /modules/Planner/resources_addQuick_ajaxProcess.php file, leading to Cross-Site Scripting (XSS) attacks. The imageAsLinks parameter must be set to "Y" for HTML code to be returned, and the filename attribute of bodyfile1 is reflected in the response, making it possible for attackers to inject malicious scripts. This vulnerability poses a significant risk, as successful exploitation could result in unauthorized access to user data or system takeover.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.