CVE-2024-23759

CRITICAL

Gambio - Insecure Deserialization

Title source: rule

Description

Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.

Exploits (1)

metasploit WORKING POC EXCELLENT

rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gambio_unauth_rce_cve_2024_23759.rb

View Code ZIP pw:eip

References (1)

[Exploit, Third Party Advisory] https://herolab.usd.de/security-advisories/usd-2023-0046/

Scores

CVSS v3 9.8

EPSS 0.6711

EPSS Percentile 98.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502 CWE-434

Status published

Affected Products (1)

gambio/gambio

Timeline

Published Feb 12, 2024

Tracked Since Feb 18, 2026