Gibbon Local File Inclusion Vulnerability Leading to Remote Code Execution

A local file inclusion vulnerability allowing remote code execution has been identified in Gibbon versions prior to 30.0.01. The issue arises from the application's handling of report archive directories, where a user can upload a ZIP file containing PHP code. Exploitation of this vulnerability requires Teacher or higher privileges and could compromise the underlying web server.

Impact

Successful exploitation allows for remote code execution on the server where Gibbon is hosted.

Reproduction

To reproduce this vulnerability, first upload a ZIP file containing a PHP executable disguised as a PDF to the Gibbon report archiving feature. After the upload, the path of the ZIP file is returned in the response. This path can be used to trigger the local file inclusion vulnerability by including it in a request to 'index.php' with the appropriate query parameter. The uploaded PHP file will be executed on the server, leading to remote code execution.

Remediation

Users are advised to update to Gibbon version 30.0.01, which addresses this vulnerability.