---
id: 3717
title: "Gibbon v30.0.00: Authenticated SQL Injection and RCE"
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/"
published_at: "2026-05-06 23:12"
tags: ["rce", "vulnerability-research", "sql-injection", "lfi", "gibbon", "school-software"]
phying_url: "https://phying.com/item/3717"
lang: en
---

# Gibbon v30.0.00: Authenticated SQL Injection and RCE

## Summary

Security research on Gibbon, an open-source school management platform: Teacher-level users and above could exploit SQL injection, LFI leading to RCE, and DoS. Fixed in v30.0.01.

## Intelligence Metadata

- **Sources:** projectblack.io
- **Published:** 2026-05-06 23:12
- **Original:** https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/
- **Phying News:** https://phying.com/item/3717