Vulnerability record · CVE-2024-24725 · published 23 March 2024
CVE-2024-24725: Gibbon PHP deserialization via columnOrder in import_run.php
Gibbonedu · Gibbon
Gibbon through 26.0.00 passes the columnOrder POST parameter to a PHP deserialization sink in modules/System Admin/import_run.php (type=externalAssessment, step=4). An authenticated user can supply a crafted serialized payload, leading to object injection and remote code execution. The flaw is a classic CWE-502 untrusted deserialization issue in a school management platform.
Description
Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with a public exploit and very high EPSS make this a serious post-authentication RCE risk, though it is not known to be exploited in the wild per KEV.
What it is
Gibbon through 26.0.00 passes the columnOrder POST parameter to a PHP deserialization sink in modules/System Admin/import_run.php (type=externalAssessment, step=4). An authenticated user can supply a crafted serialized payload, leading to object injection and remote code execution. The flaw is a classic CWE-502 untrusted deserialization issue in a school management platform.
Impact
An attacker with a valid low-privileged account gains code execution in the web application context, compromising confidentiality, integrity and availability of the Gibbon instance and its data.
Attack surface
Reached over the network via a POST request to the import_run.php endpoint with type=externalAssessment and step=4; authentication is required (PR:L) and no user interaction is needed (UI:N).
Exploitation
A public Exploit-DB entry (51903) exists, and EPSS is 0.5132 (98.9th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.
What to do
- Upgrade Gibbon to a version later than 26.0.00 that removes or hardens the deserialization path.
- If patching is not immediately possible, restrict access to modules/System Admin/import_run.php to trusted administrators only.
- Replace PHP unserialize on user-controlled input with safe formats such as JSON, or enforce allowed_classes restrictions.
- Audit and remove unused import/assessment functionality that exposes the vulnerable endpoint.
- Monitor and alert on POST requests to import_run.php containing serialized object patterns in columnOrder.
Detection
- Search web logs for POST requests to modules/System Admin/import_run.php with type=externalAssessment and step=4.
- Inspect columnOrder values for PHP serialization markers such as O:, a:, or C: in request bodies.
- Alert on unexpected child processes or file writes spawned by the web server user following import_run.php requests.
- Review accounts with import privileges for anomalous or newly created sessions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://gibbonedu.org/download/ | Product |
| https://www.exploit-db.com/exploits/51903 | Exploit |
| https://gibbonedu.org/download/ | Product |
| https://www.exploit-db.com/exploits/51903 | Exploit |
Track CVE-2024-24725 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-24725), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
