CVE-2023-45878: Gibbon unauthenticated arbitrary file write via rubrics_visualise_saveAjax.phps

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated network-accessible arbitrary file write leading to remote code execution with a CVSS of 9.8 and high EPSS.

What it is

Gibbon 25.0.1 and earlier exposes rubrics_visualise_saveAjax.phps without authentication, accepting img, path and gibbonPersonID parameters. The img parameter is base64-decoded and written to a path built from the attacker-supplied path value and the installation directory, allowing arbitrary file creation. Because PHP files can be written, this leads to unauthenticated remote code execution.

Impact

An unauthenticated attacker can write arbitrary files, including PHP, into the web-accessible installation directory and execute them, gaining remote code execution on the server.

Attack surface

Reachable over the network via the rubrics_visualise_saveAjax.phps endpoint; no authentication or user interaction is required per the CVSS vector and description.

Exploitation

Not listed in CISA KEV, but EPSS is 0.63113 (99.166th percentile) and the only references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade Gibbon to a version later than 25.0.1 that fixes the unauthenticated file write.
• If upgrade is not possible, block or restrict access to rubrics_visualise_saveAjax.phps at the web server or WAF.
• Remove write permissions on the web root for the web server user so PHP files cannot be created there.
• Disable PHP execution in upload or data directories via web server configuration.
• Audit the installation directory for unexpected PHP files and remove any found.

Detection

• Monitor web logs for POST requests to rubrics_visualise_saveAjax.phps, especially with img, path and gibbonPersonID parameters.
• Alert on creation of new PHP files in the Gibbon installation directory.
• Look for base64-encoded payloads in request bodies to that endpoint.
• Check for outbound or child processes spawned by the web server user indicating code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.