SecondX.io Research Team

2 exploits Active since Mar 2024
CVE-2024-24725 EXPLOITDB HIGH python WORKING POC
Gibbon < 26.0.00 - Authenticated PHP Deserialization via columnOrder Parameter
Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.
CVSS 8.8
CVE-2024-24724 EXPLOITDB CRITICAL text WORKING POC
Gibbon < 26.0.00 - Server-Side Template Injection via Messenger Settings
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.
CVSS 9.8