CVE-2023-45878

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://herolab.usd.de/security-advisories/usd-2023-0025/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gibbonedu:gibbon:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-11-14 06:15

Updated : 2023-11-17 21:33

NVD link : CVE-2023-45878

Mitre link : CVE-2023-45878

CVE.ORG link : CVE-2023-45878

JSON object : View

Products Affected

gibbonedu

gibbon

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-45878", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-11-14T06:15:29.040", "references": [{"url": "https://herolab.usd.de/security-advisories/usd-2023-0025/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated)."}, {"lang": "es", "value": "GibbonEdu Gibbon versi\u00f3n 25.0.1 y anteriores permite la escritura arbitraria de archivos porque rubrics_visualise_saveAjax.phps no requiere autenticaci\u00f3n. El endpoint acepta los par\u00e1metros img, path y gibbonPersonID. Se espera que el par\u00e1metro img sea una imagen codificada en base64. Si se establece el par\u00e1metro de ruta, la ruta definida se utiliza como carpeta de destino, concatenada con la ruta absoluta del directorio de instalaci\u00f3n. El contenido del par\u00e1metro img se decodifica en base64 y se escribe en la ruta del archivo definida. Esto permite la creaci\u00f3n de archivos PHP que permiten la ejecuci\u00f3n remota de c\u00f3digo (no autenticado)."}], "lastModified": "2023-11-17T21:33:27.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gibbonedu:gibbon:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41E3249E-3016-411A-8B2F-5B534497F33C", "versionEndIncluding": "25.0.01"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}