CVE-2024-24725

This exploit leverages a PHP deserialization vulnerability in Gibbon LMS v26.0.00 to achieve remote code execution (RCE). It authenticates, generates a malicious payload, and sends it via a crafted multipart/form-data request to trigger command execution.

This repository contains a functional PHP exploit for CVE-2024-24725, targeting the Gibbon School Management System. The exploit chains authentication bypass with RCE via crafted multipart/form-data requests to the import_run.php endpoint.

This Metasploit module exploits a PHP deserialization vulnerability in Gibbon School Platform (CVE-2024-24725) to achieve remote code execution. It authenticates, uploads a malicious payload via a crafted POST request, and executes arbitrary commands.