Skip to content
Fencer Vulns
critical 9.8

CVE-2023-45878 in the critical feed json

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authenticat…

published 2023-11-14 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-50143

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
63.4%
EPSS 63.4% chance of exploitation in 30 days, percentile 99.2%
public exploits
0
none known, plus a Nuclei check

Summary

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

63.37% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Gibbon LMS <= v25.0.01 - File Upload to RCE nuclei detection template
  • herolab.usd.de https://herolab.usd.de/security-advisories/usd-2023-0025/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.