CVE-2023-34598

published 2023-06-29

CVE-2023-34598: Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in…

Priority P1 85 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
gibbonedu	gibbon	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /?q=./gibbon.sql↗

path /gibbon.sql↗

• → HTTP GET request to /?q=./gibbon.sql; a 200 response containing both 'phpMyAdmin SQL Dump' and 'gibbon' in the body confirms successful LFI exploitation of the gibbon.sql installation file. ↗
• → Identify exposed Gibbon installations via Shodan favicon hash -165631681 or FOFA icon_hash -165631681 to find potentially vulnerable targets. ↗
• → Response body keyword match: presence of 'phpMyAdmin SQL Dump' AND 'gibbon' in the HTTP response body indicates the SQL dump file was successfully included and returned. ↗

• · The vulnerability affects specifically Gibbon v25.0.0; the LFI is triggered via the 'q' query parameter pointing to files within the installation folder. ↗
• · The template targets gibbon.sql specifically, but the vulnerability description states 'several files' in the installation folder are includable — additional paths beyond gibbon.sql may be exploitable. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22