{"id":"CVE-2024-24725","aliases":["EUVD-2024-22124","GHSA-6wfg-rr5q-wg74"],"status":"published","title":"Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks...","description":"Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php\u0026type=externalAssessment\u0026step=4 URI.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.51602,"percentile":0.98954,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-502"],"published":"2024-03-23T00:00:00Z","modified":"2026-10-28T02:30:58Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/gibbon_auth_rce_cve_2024_24725","title":"Gibbon School Platform Authenticated PHP Deserialization Vulnerability","type":"exploit","platform":"Linux,PHP,Unix,Windows","date":"2024-03-18","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/gibbon_auth_rce_cve_2024_24725"},{"source":"pocgithub","id":"MelkorW/CVE-2024-24725-PoC","title":"MelkorW/CVE-2024-24725-PoC","date":"2024-10-24","url":"https://github.com/MelkorW/CVE-2024-24725-PoC"}],"products":[{"vendor":"gibbonedu","product":"gibbon"}],"references":[{"url":"https://gibbonedu.org/download/","tags":["x_transferred","Product","web"]},{"url":"https://www.exploit-db.com/exploits/51903","tags":["x_transferred","Exploit","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24725","tags":["advisory"]},{"url":"https://gibbonedu.org/download"},{"url":"https://github.com/advisories/GHSA-6wfg-rr5q-wg74"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24725.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-24725","description":"Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php\u0026type=externalAssessment\u0026step=4 URI.","status":"published","published":"2024-03-23T00:00:00Z","modified":"2024-08-27T17:18:28.014Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:13.991836Z"}],"euvd":[{"id":"EUVD-2024-22124","description":"Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php\u0026type=externalAssessment\u0026step=4 URI.","status":"published","published":"2024-03-23T00:00:00Z","modified":"2024-08-27T17:18:28Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:10.428773Z"}],"ghsa":[{"id":"GHSA-6wfg-rr5q-wg74","title":"Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks...","description":"Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php\u0026type=externalAssessment\u0026step=4 URI.","status":"published","published":"2024-03-24T00:30:32Z","modified":"2024-08-27T21:32:18Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:58:06.582466Z"}],"nvd":[{"id":"CVE-2024-24725","description":"Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php\u0026type=externalAssessment\u0026step=4 URI.","status":"published","published":"2024-03-23T23:15:07.193Z","modified":"2026-06-17T07:14:45.51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"CVE-2024-24725","description":"Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php\u0026type=externalAssessment\u0026step=4 URI.","status":"published","published":"2024-03-23T00:00:00Z","modified":"2026-10-28T02:30:58.254016709Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:38.897406Z"}]}}