CVE-2023-45878

Medium PUBLISHED

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The...

GibbonEdu · Gibbon

Not yet in CISA KEV

PoC available

Recommended Action

Review exposure in your environment and monitor for exploitation signals before broader rollout.

Confidence
Medium
Exploitation Status
PoC available
Observed in Sensors
No
Attempts (30d)
Unique Attacker IPs
CISA KEV
Not yet in CISA KEV
CVSS / EPSS
9.8 Critical

At a Glance

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).

nuclei_scanner
Published
Nov 14, 2023
First Seen
Jul 21, 2025
CVSS
9.8 Critical
EPSS
Remote Low complexity No user interaction Unauthenticated

Recommended Actions

  • Review exposure in your environment and monitor for exploitation signals before broader rollout.
  • Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
  • Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.