CVE-2023-34598

CVE-2023-34598 - Gibbon v25.0.0 LFI Exploit This repository contains a Python script that helps identify and exploit a local file inclusion LFI vulnerability CVE-2023-34598 in Gibbon v25.0.0. The script can scan a target website for potential vulnerability and, if successful, download the SQL dum...

CVE-2023-45878

Exploit de Gibbon CMS CVE-2023-45878 Este script de Python explota CVE-2023-45878, una vulnerabilidad de carga arbitraria de archivos sin autenticación en Gibbon CMS versiones 25.0.1 y anteriores, que permite la Ejecución Remota de Código RCE. Descripción de la vulnerabilidad CVE-2023-45878 exist...

CVE-2023-45878

CVE-2023-45878 Wrote this script based on the work of https://herolab.usd.de/security-advisories/usd-2023-0025/ . The exploit works by using an Arbitrary File Write exploit in Gibbon LMS 25.0.1 . This PoC will use upload a simple php cmd script, and then use that to load a powershell revshell...

Gibbon v25.0.0 - Cross-Site Scripting

Multiple Cross-Site Scripting XSS vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code. id: CVE-2023-34599 info: name: Gibbon v25.0.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Multiple Cross-Site...

Gibbon LMS <= v25.0.01 - File Upload to RCE

Gibbon LMS versions 25.0.1 and earlier are vulnerable to an Arbitrary File Upload that can lead to Remote Code Execution RCE. The issue stems from the rubricsvisualisesaveAjax.php endpoint, which, notably, does not require authentication. Because of this, unauthenticated attackers could potential...

Gibbon v25.0.0 - Local File Inclusion

Gibbon v25.0.0 is vulnerable to a Local File Inclusion LFI vulnerability where it's possible to include the content of several files present in the installation folder in the server's response. id: CVE-2023-34598 info: name: Gibbon v25.0.0 - Local File Inclusion author: DhiyaneshDk severity:...

CVE-2021-40492

CVE-2021-40492 CVE-2021-40492 Vulnerabilidades de Cross Site Scripting XSS Reflejado en Gibbon versión 22. https://vulners.com/cve/CVE-2021-40492 Existe una vulnerabilidad de Cross Site Scripting reflejado en varias páginas de la versión 22 de la aplicación educativa Gibbon que permite la ejecuci...

CVE-2023-34598

CVE-2023-34598 Gibbon Local File Inclusion Vulnerability CVE-2023-34598...

CVE-2023-34599

CVE-2023-34599 Sono state identificate multiple vulnerabilità di Cross-Site Scripting XSS in Gibbon v25.0.0, che consentono agli attaccanti di eseguire codice JavaScript arbitrario. Prova di concetto Parametro allUsers http://gibbon.local/index.php?q=/modules/Timetable...

CVE-2023-45878_to_RCE

CVE-2023-45878 a RCE Questo script incatena e automatizza la scrittura arbitraria di file in RCE su Gibbon LMS attraverso lo sfruttamento di CVE-2023-45878. Lo script esegue i seguenti passaggi: 1. Genera una reverse shell stageless con msfvenom per Windows 2. Carica una webshell sfruttando...

CVE-2023-34598

Gibbon v25.0.0 - Inclusioni locali di file - CVE-2023-34598 Gibbon v25.0.0 è vulnerabile a una vulnerabilità di inclusione locale di file LFI, dove è possibile includere il contenuto di diversi file presenti nella cartella di installazione nella risposta del server. Prova di concetto Per sfruttar...

CVE-2023-45878-POC

CVE-2023-45878-POC CVE-2023-45878 PoC per Gibbon LMS su XAMPP Windows. Carica una webshell chiamata shell.php per l'iniezione di comandi. Per la reverse shell carica uno script PowerShell di reverse shell ps1 chiamato shell.ps1 che viene caricato sulla macchina target usando shell.php. Requisiti...

gibbonlms-filewrite_rce

Gibbon LMS Scrittura Arbitraria di File / RCE Informazioni sulla Vulnerabilità Scrittura Arbitraria di File in Gibbon LMS per RCE CVE-2023-45878 GibbonEdu Gibbon LMS versione 25.0.1 e precedenti permette la scrittura arbitraria di file perché rubricsvisualisesaveAjax.php non richiede...

CVE-2023-45878

CVE-2023-45878 Exploit GibbonEdu Gibbon versione 25.0.1 GibbonEdu Gibbon versione 25.0.1 e precedenti GibbonEdu Gibbon versione 25.0.1 e precedenti consente la scrittura arbitraria di file Leggi di più https://nvd.nist.gov/vuln/detail/CVE-2023-45878...

CVE-2026-8209

Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges...

CVE-2026-8207

Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/core/blob/c431e25fdc874adece5d2dc7e408e9aa2d1abadb/modules/Tracking/graphing.phpL145 feature. Successful exploitation requires Teacher or high...

CVE-2026-8208

Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user provided .zip as PHP. Successful exploitation requires Teacher or higher privileges. Exploitation could result in...

CVE-2026-8209

Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges...

CVE-2026-8208

Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user provided .zip as PHP. Successful exploitation requires Teacher or higher privileges. Exploitation could result in...

CVE-2026-8209

Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges...