CVE-2023-45878

CVE-2023-45878 Wrote this script based on the work of https://herolab.usd.de/security-advisories/usd-2023-0025/ . The exploit works by using an Arbitrary File Write exploit in Gibbon LMS 25.0.1 . This PoC will use upload a simple php cmd script, and then use that to load a powershell revshell...

Gibbon LMS <= v25.0.01 - File Upload to RCE

Gibbon LMS versions 25.0.1 and earlier are vulnerable to an Arbitrary File Upload that can lead to Remote Code Execution RCE. The issue stems from the rubricsvisualisesaveAjax.php endpoint, which, notably, does not require authentication. Because of this, unauthenticated attackers could potential...

CVE-2023-45878_to_RCE

CVE-2023-45878에서 RCE로 이 스크립트는 CVE-2023-45878 취약점을 이용하여 Gibbon LMS에서 임의 파일 쓰기Arbitrary File Write를 RCE로 연쇄 및 자동화합니다. 이 스크립트는 다음 단계를 수행합니다: 1. Windows용 msfvenom 스테이지리스 리버스 셸을 생성합니다. 2. CVE-2023-45878을 악용하는 웹셸을 업로드합니다. 3. 타겟에 리버스 셸을 다운로드합니다. 4. 리버스 셸을 실행합니다...

CVE-2023-45878-POC

CVE-2023-45878-POC CVE-2023-45878のPOC - XAMPP Windows上のGibbon LMS向け。 コマンドインジェクション用のwebshell（shell.php）をアップロードします。 リバースシェルの場合、shell.ps1というPowerShellリバースシェルスクリプトをアップロードします。これはshell.phpを使用してターゲットマシンにアップロードされます。 必要条件 Python3 Requests Python3モジュール netcat root@kitploit: pip3 install requests 仮想環境...

gibbonlms-filewrite_rce

Gibbon LMS 任意ファイル書き込み / RCE 脆弱性情報 Gibbon LMS における RCE を可能にする任意ファイル書き込み CVE-2023-45878 GibbonEdu Gibbon LMS バージョン 25.0.1 以前では、rubricsvisualisesaveAjax.php が認証を必要としないため、任意ファイル書き込みが可能です。このエンドポイントは、img、path、gibbonPersonID パラメータを受け入れます。img パラメータは、base64 エンコードされた画像であることが想定されています。path...

Exploit for Out-of-bounds Write in Gibbonedu Gibbon

Gibbon LMS Arbitrary File Write / RCE Vulnerability Informa...

Exploit for Out-of-bounds Write in Gibbonedu Gibbon

CVE-2023-45878 to RCE !cve-2023-45878torcehttps://github...

Exploit for Out-of-bounds Write in Gibbonedu Gibbon

CVE-2023-45878-POC CVE-2023-45878 poc for gibbon LMS on xampp...

Exploit for Out-of-bounds Write in Gibbonedu Gibbon

CVE-2023-45878 Wrote this script based on the work of https:/...

Gibbon LMS v26.0.00 - SSTI vulnerability

Exploit Title: Gibbon LMS v26.0.00 - SSTI vulnerability Date: 21.01.2024 Exploit Author: SecondX.io Research TeamIslam Rzayev,Fikrat Guliev, Ali Maharramli Vendor Homepage: https://gibbonedu.org/ Software Link: https://github.com/GibbonEdu/core Version: v26.0.00 Tested on: Ubuntu 22.0 CVE :...

Gibbon 26.0.00 Server-Side Template Injection / Remote Code Execution

Exploit Title: Gibbon LMS has an SSTI vulnerability on the v26.0.00 version Date: 21.01.2024 Exploit Author: SecondX.io Research TeamIslam Rzayev,Fikrat Guliev, Ali Maharramli Vendor Homepage: https://gibbonedu.org/ Software Link: https://github.com/GibbonEdu/core Version: v26.0.00 Tested on:...

Gibbon 26.0.00 Server-Side Template Injection / Remote Code Execution Exploit

Exploit Title: Gibbon LMS has an SSTI vulnerability on the v26.0.00 version Exploit Author: SecondX.io Research TeamIslam Rzayev,Fikrat Guliev, Ali Maharramli Vendor Homepage: https://gibbonedu.org/ Software Link: https://github.com/GibbonEdu/core Version: v26.0.00 Tested on: Ubuntu 22.0 CVE :...

Gibbon LMS 26.0.00 PHP Deserialization / Code Execution

Exploit Title: Gibbon LMS has a PHP Deserialization vulnerability on the v26.0.00 version Date: 22.01.2024 Exploit Author: SecondX.io Research TeamAli Maharramli,Fikrat Guliev,Islam Rzayev Vendor Homepage: https://gibbonedu.org/ Software Link: https://github.com/GibbonEdu/core Version: v26.0.00...

Gibbon LMS < v26.0.00 - Authenticated Remote Code Execution Exploit

Exploit Title: Gibbon LMS has a PHP Deserialization vulnerability on the v26.0.00 version Exploit Author: SecondX.io Research TeamAli Maharramli,Fikrat Guliev,Islam Rzayev Vendor Homepage: https://gibbonedu.org/ Software Link: https://github.com/GibbonEdu/core Version: v26.0.00 Tested on: Ubuntu...

Gibbon LMS < v26.0.00 - Authenticated RCE

Exploit Title: Gibbon LMS has a PHP Deserialization vulnerability on the v26.0.00 version Date: 22.01.2024 Exploit Author: SecondX.io Research TeamAli Maharramli,Fikrat Guliev,Islam Rzayev Vendor Homepage: https://gibbonedu.org/ Software Link: https://github.com/GibbonEdu/core Version: v26.0.00...