This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: CVE-2024-24725 is a **PHP Deserialization** flaw in Gibbon. π **Consequences**: Attackers can manipulate the `columnOrder` parameter via POST requests to execute arbitrary code.β¦
π« **Affected**: **Gibbon** School Platform. π¦ **Version**: **26.0.00 and earlier**. π **Published**: March 23, 2024. π Target: Educational institutions using this specific version.
Q4What can hackers do? (Privileges/Data)
π» **Hackers Can**: Execute **Remote Code Execution (RCE)**. π Gain full control over the server. π Access sensitive student/educator data. π Modify system configurations via the `externalAssessment` import module.
Q5Is exploitation threshold high? (Auth/Config)
β‘ **Threshold**: **Low**. π Requires a **POST request**. π― Specific endpoint: `import_run.PHP&type=externalAssessment&step=4`. π Auth requirements not specified, but the vector is direct via HTTP parameters.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Public Exploit**: **YES**. π PoC available on GitHub: `MelkorW/CVE-2024-24725-PoC`. π Exploit-DB entry #51903 exists. β οΈ Wild exploitation is highly likely given the PoC availability.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for Gibbon v26.0.00 or older. π‘ Monitor logs for POST requests to `import_run.PHP` with `type=externalAssessment`. π§ͺ Test the `columnOrder` parameter for deserialization artifacts.β¦
π οΈ **Fix**: Upgrade Gibbon to a version **newer than 26.0.00**. π₯ Download latest from `gibbonedu.org/download/`. π Apply vendor patches immediately.β¦
π§ **No Patch?**: Block access to `import_run.PHP`. π« Whitelist IPs for the `System Admin` module. π‘οΈ Input validation on `columnOrder` if code modification is possible.β¦
π¨ **Urgency**: **HIGH**. π₯ Public PoC exists. π£ RCE impact is critical. π« Schools are high-value targets. β³ Patch immediately to prevent data breaches and server takeover.