CVE-2023-34598 PoC — Gibbon 路径遍历漏洞

Source

Associated Vulnerability

Description

Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) vulnerability where it's possible to include the content of several files present in the installation folder in the server's response.

Readme

# Gibbon v25.0.0 - Local File Inclusion - CVE-2023-34598
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) vulnerability where it's possible to include the content of several files present in the installation folder in the server's response.

# Proof of Concept
In order to exploit the vulnerability, an attacker would need to manipulate the "q" parameter to query a local file. This manipulation would cause the file to be included in the server's response. However, it's important to note that this exploit is only effective for files located within the installation folder and under specific conditions, which exclude PHP files, for instance.

http://gibbon.local/q=./file

![image](https://github.com/maddsec/CVE-2023-34598/assets/88505855/1bd4f4f0-c883-4675-9601-d06b279ee95a)

![image](https://github.com/maddsec/CVE-2023-34598/assets/88505855/bde6f62f-8a35-49a7-a306-c9a2c50af7c9)

# Vendor information:
Name: Gibbon
URL: https://gibbonedu.org
Github repo: https://github.com/GibbonEdu/core

File Snapshot

 [4.0K]  /data/pocs/75d473b648cd29046ba7b102ba967f4a39ee293a
└── [1009]  README.md

0 directories, 1 file

Remarks