PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Gibbon v30.0.00: Authenticated SQL Injection and RCE

projectblack.io | research | #rce | #vulnerability-research | #sql-injection | #lfi | #gibbon | #school-software
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Security research on Gibbon, an open-source school management platform: Teacher-level users and above could exploit SQL injection, LFI leading to RCE, and DoS. Fixed in v30.0.01.
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
vulnerability · horizon3.ai
[CVE-2021-41765] Multiple Vulnerabilities in ResourceSpace
Advisory for CVE-2021-41765, a critical SQL injection vulnerability leading to remote code execution, by the Horizon3 red team.
vulnerability · horizon3.ai
CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS < 21.1.0
# CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS * * * ##### How can NodeZero help you? Let our experts walk you through a demonstration of NodeZero®, so you can see how to...
Back