POC详情： 75d473b648cd29046ba7b102ba967f4a39ee293a

来源
https://github.com/maddsec/CVE-2023-34598
关联漏洞
标题： Gibbon 路径遍历漏洞 (CVE-2023-34598)
描述：Gibbon是一个解决教育工作者每天遇到的实际问题的学校平台。 Gibbon 25.0.0版本存在安全漏洞，该漏洞源于存在本地文件包含漏洞。攻击者可利用该漏洞在服务器响应中包含本地文件。
描述
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) vulnerability where it's possible to include the content of several files present in the installation folder in the server's response.
介绍
# Gibbon v25.0.0 - Local File Inclusion - CVE-2023-34598
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) vulnerability where it's possible to include the content of several files present in the installation folder in the server's response.

# Proof of Concept
In order to exploit the vulnerability, an attacker would need to manipulate the "q" parameter to query a local file. This manipulation would cause the file to be included in the server's response. However, it's important to note that this exploit is only effective for files located within the installation folder and under specific conditions, which exclude PHP files, for instance.

http://gibbon.local/q=./file

![image](https://github.com/maddsec/CVE-2023-34598/assets/88505855/1bd4f4f0-c883-4675-9601-d06b279ee95a)

![image](https://github.com/maddsec/CVE-2023-34598/assets/88505855/bde6f62f-8a35-49a7-a306-c9a2c50af7c9)

# Vendor information:
Name: Gibbon
URL: https://gibbonedu.org
Github repo: https://github.com/GibbonEdu/core
文件快照

 [4.0K]  /data/pocs/75d473b648cd29046ba7b102ba967f4a39ee293a
└── [1009]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。