目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CVE-2023-34598 PoC — Gibbon 路径遍历漏洞

来源
https://github.com/maddsec/CVE-2023-34598
关联漏洞
标题:Gibbon 路径遍历漏洞 (CVE-2023-34598)
Description:Gibbon是一个解决教育工作者每天遇到的实际问题的学校平台。 Gibbon 25.0.0版本存在安全漏洞，该漏洞源于存在本地文件包含漏洞。攻击者可利用该漏洞在服务器响应中包含本地文件。
Description
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) vulnerability where it's possible to include the content of several files present in the installation folder in the server's response.
介绍
# Gibbon v25.0.0 - Local File Inclusion - CVE-2023-34598
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) vulnerability where it's possible to include the content of several files present in the installation folder in the server's response.

# Proof of Concept
In order to exploit the vulnerability, an attacker would need to manipulate the "q" parameter to query a local file. This manipulation would cause the file to be included in the server's response. However, it's important to note that this exploit is only effective for files located within the installation folder and under specific conditions, which exclude PHP files, for instance.

http://gibbon.local/q=./file

![image](https://github.com/maddsec/CVE-2023-34598/assets/88505855/1bd4f4f0-c883-4675-9601-d06b279ee95a)

![image](https://github.com/maddsec/CVE-2023-34598/assets/88505855/bde6f62f-8a35-49a7-a306-c9a2c50af7c9)

# Vendor information:
Name: Gibbon
URL: https://gibbonedu.org
Github repo: https://github.com/GibbonEdu/core
文件快照

 [4.0K]  /data/pocs/75d473b648cd29046ba7b102ba967f4a39ee293a
└── [1009]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。