CVE-2024-24725: Gibbonedu Gibbon RCE Vulnerability

CVE-2024-24725 Overview

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.

Critical Impact
This vulnerability enables attackers to leverage PHP object injection, potentially leading to arbitrary code execution.

Affected Products

Gibbonedu Gibbon

Discovery Timeline

2024-03-23T23:15:07.193 - CVE CVE-2024-24725 published to NVD
2025-07-29T20:05:15.367 - Last updated in NVD database

Technical Details for CVE-2024-24725

Vulnerability Analysis

The vulnerability stems from improper handling of serialized PHP objects in user inputs. An attacker can craft serialized payloads to perform unauthorized operations or run arbitrary code within the application.

Root Cause

Improper deserialization of user-controlled data sent to the application allows crafted PHP objects to be processed unsafely.

Attack Vector

Network-based remote authenticated attack via crafted POST requests targeting the import_run.php script.

php

// Example exploitation code (sanitized)
$postData = array(
    'columnOrder' => 'O:8:"Exploit":0:{}'
);

$ch = curl_init('https://example.com/modules/System Admin/import_run.php&type=externalAssessment&step=4');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);
$response = curl_exec($ch);
curl_close($ch);

Detection Methods for CVE-2024-24725

Indicators of Compromise

Unusual serialization payloads in POST requests
Suspicious activity logs involving import_run.php
Unanticipated system behavior without relevant activity

Detection Strategies

Monitoring POST data for serialized PHP objects and pattern matching against known payloads can help detect exploitation attempts.

Monitoring Recommendations

Implement logging and alerting for POST requests to critical endpoints. Consider using serialization detection tools to identify potential attacks.

How to Mitigate CVE-2024-24725

Immediate Actions Required

Update to the latest version of Gibbonedu
Implement strict input validation checks
Enable web application firewall (WAF) protections

Patch Information

Check the vendor advisory at Gibbonedu Downloads.

Workarounds

Disable or limit serialization processing within affected scripts or apply input filtering validation to prevent deserialization.

bash

# Configuration example
# Disable deserialization in affected scripts
disable_functions = unserialize