CVE-2024-24724

published 2024-04-03

CVE-2024-24724: Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is…

Priority P1 78 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
gibbonedu	gibbon	<= 26.0.00	—

Detection & IOCs extracted from sources · hover to see the quote

• · Exploitation requires valid authenticated credentials; the exploit performs a login step first and uses the resulting session cookie for the SSTI injection. Detections based solely on the injection endpoint may miss unauthenticated probing attempts but should still fire on authenticated abuse. ↗
• · The vulnerability exists in the `signatureTemplate` field which is stored and later rendered by the Twig engine; the payload is injected via POST but triggered on a subsequent GET request, meaning a single-request detection may not capture the full attack chain. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-1336