CVE-2024-24725

HIGH

Gibbon LMS < v26.0.00 - Authenticated RCE

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-24725 has a selected CVSS score of 8.8 (high); EIP currently links 2 catalogued exploits and 1 repository PoC.

Description

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
2
Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 27, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

gibbon

Browse gibbonedu / gibbon

Default status: unknown

CVE ListThrough 26.0.0affected

Proofs of concept

3

Catalogued exploits

ExploitDBGibbon LMS < v26.0.00 - Authenticated RCEExploitDB exploitby Ali Maharramli_Fikrat Guliev_Islam RzayevNot analyzed1 file
ExploitDB
PoC details
MetasploitGibbon School Platform Authenticated PHP Deserialization VulnerabilityMetasploit exploitby Ali Maharramli +3 moreNot analyzed1 file

Ruby

Metasploit
PoC details

Repository PoCs

GitHubMelkorW/CVE-2024-24725-PoCRepository PoCby MelkorW1Not analyzed2 files

6.8 KiB

GitHub
PoC details

References

3