critical9.8Public exploit code
CVE-2024-24724
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is pa…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Gibbon LMS v26.0.00 - SSTI vulnerability2024-04-02 · webapps · php
Impact
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gibbonedu | Gibbon | through 26.0.00 |