Gibbon EUVD-2026-28880

Requires valid authenticated session with Teacher role or higher privileges in Gibbon's role-based access control system. The specific vulnerable code path at modules/Tracking/graphing.php line 145 must be accessible to the authenticated user - this requires the Tracking module to be enabled and permissions granted to the Teacher role. Network access to the Gibbon web interface (typically HTTPS port 443 or HTTP port 80) is required but exploitation is post-authentication, not unauthenticated remote. The vulnerability is NOT exploitable by unauthenticated users, students with lower privileges, or external attackers without valid credentials. Attack complexity is low (AC:L) once credentials are obtained - no race conditions, cryptographic bypasses, or complex timing requirements. Limiting factors: multi-factor authentication on Teacher accounts, IP allowlisting for administrative interfaces, or disabling the Tracking module entirely would prevent exploitation even with compromised credentials.

The CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N) indicates network-accessible exploitation with low complexity but requiring high privileges (Teacher or Admin role). CVSS base score of 7.0 reflects high confidentiality impact and low integrity impact with no availability impact. Real-world risk depends critically on privilege model - the vulnerability requires legitimate Teacher credentials, not unauthenticated remote access. However, Teacher accounts are numerous in typical school deployments and may have weaker security controls than admin accounts. The publicly available exploit from Project Black significantly lowers the skill barrier for exploitation. Vendor release notes downplay severity as 'low severity, accessible to admin users only' but this conflicts with the description stating 'Teacher or higher' - Teacher is not admin in most educational access models. No EPSS score provided and not listed in CISA KEV, suggesting limited observed exploitation in the wild despite POC availability. SSVC factors: exploitation state is POC (public code exists), automatable is yes (network SQL injection), technical impact is partial (database read/write but not system compromise). Priority should be moderate - not critical infrastructure risk but warrants patching within standard maintenance windows, especially for internet-facing instances or schools with elevated insider threat concerns.

An attacker with compromised Teacher account credentials (obtained via phishing, credential stuffing, or insider access) authenticates to a Gibbon instance and navigates to the Tracking/graphing feature. By manipulating HTTP parameters in requests to graphing.php, the attacker injects SQL commands that bypass the application logic. Using UNION-based or blind SQL injection techniques documented in the Project Black exploit, the attacker extracts sensitive data from the database including student records, staff information, and administrative credentials stored in other tables. The attacker could also modify grades, attendance records, or insert malicious data to maintain persistence or disrupt school operations.