Gibbon Multiple Vulnerabilities

Local file inclusion in Gibbon school management system versions prior to v30.0.01 enables remote code execution when authenticated users with Teacher or higher privileges manipulate the report archive directory setting to force interpretation of a malicious ZIP file as PHP code. The vulnerability compromises the underlying web server. Project Black Security Services disclosed this flaw with a detailed proof-of-concept, and the vendor released patch v30.0.01 marking it as low severity since it requires administrative access. EPSS data not available, but the high CVSS 8.9 score reflects the critical post-compromise impact despite the high privilege requirement.

SQL injection in Gibbon education platform versions prior to v30.0.01 enables authenticated users with Teacher privileges or higher to execute arbitrary SQL queries through the Tracking/graphing module. Exploitation allows unauthorized read and write access to the underlying database. Project Black Security Services has published detailed exploit documentation demonstrating the attack. While vendor release notes classify this as 'low severity, accessible to admin users only,' the CVSS 7.0 score and authenticated Teacher-level access requirement indicate moderate risk for multi-tenant or compromised-account scenarios.

Denial of service in Gibbon versions before v30.0.01 via path traversal during ZIP file extraction allows authenticated users with Teacher or higher privileges to trigger file deletion and application unavailability. The vulnerability exploits improper handling of malicious ZIP archives, where failed extraction attempts result in unintended deletion of PHP application files. This requires elevated privileges within the application and network access to the vulnerable endpoint.