CVE-2023-45878
Published: 14 November 2023
Summary
CVE-2023-45878 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Gibbonedu Gibbon. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
GibbonEdu Gibbon versions 25.0.1 and earlier contain an unauthenticated arbitrary file write vulnerability in the rubrics_visualise_saveAjax.phps endpoint. The script accepts base64-encoded content via the img parameter along with a user-controlled path value that is concatenated with the application's installation directory, writing the decoded data to an arbitrary location on disk. This flaw maps to CWE-787 and carries a CVSS 3.1 score of 9.8.
An unauthenticated remote attacker can supply a malicious PHP payload in the img parameter and a suitable path to drop a web shell or other executable file under the web root, resulting in remote code execution with the privileges of the web server process. No authentication or user interaction is required, and the gibbonPersonID parameter is accepted but not needed for exploitation.
The usd AG advisory USD-2023-0025 published at herolab.usd.de details the issue and confirms the affected endpoint behavior. The associated EPSS score has remained consistently high, reaching a peak of 0.9271 and currently sitting at 0.9256, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50143
Vulnerability details
GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter…
more
is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.