CVE-2024-24725
Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.
- Affected products
- Gibbon
- Gibbonedu Gibbon
- ≤ 26.0.00
- CVSS 3.1
- 8.8 HIGH
- EPSS
- 51.3% (99th percentile)
- Weakness
- CWE-502
- NVD status
- Analyzed
- Published
- 2024-03-23
CVE-2024-24725 at NVD
6 known exploits for CVE-2024-24725
Proof-of-concept code and exploit modules indexed by Sploitus
Gibbon School Platform Authenticated PHP Deserialization Exploit
Gibbon School Platform 26.0.00 Remote Code Execution
Gibbon LMS 26.0.00 PHP Deserialization / Code Execution
Gibbon LMS < v26.0.00 - Authenticated RCE
Gibbon LMS < v26.0.00 - Authenticated Remote Code Execution Exploit
Gibbon School Platform Authenticated PHP Deserialization Vulnerability