CVE-2024-24724: Gibbon LMS v26.0.00 - SSTI vulnerability
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24724?
CVE-2024-24724 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-24724?
To fix CVE-2024-24724, update Gibbon LMS to version 26.0.01 or later where the vulnerability is patched.
What causes CVE-2024-24724?
CVE-2024-24724 is caused by server-side template injection in the messengerSettings.php file, allowing unvalidated input to be processed by the Twig template engine.
Which versions of Gibbon LMS are affected by CVE-2024-24724?
Gibbon LMS versions up to and including 26.0.00 are affected by CVE-2024-24724.
What can happen if CVE-2024-24724 is exploited?
If exploited, CVE-2024-24724 could allow an attacker to execute arbitrary code on the server, leading to full system compromise.