CVE-2024-24725

Published: Mar 23, 2024Modified: Jul 29, 2025

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.

Affected (1)

Products: Gibbonedu: Gibbon

Gibbonedu

1 product

Gibbon

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gibbonedu Gibbon	Up to 26.0.00

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

https://gibbonedu.org/download/

Source: cve@mitre.org

Product

https://www.exploit-db.com/exploits/51903

Source: cve@mitre.org

Exploit

https://gibbonedu.org/download/

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://www.exploit-db.com/exploits/51903

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.