Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
GibbonEdu Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2023-45881 - Vulnerability Database
GibbonEdu

GibbonEdu Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2023-45881

Medium
Reference: CVE-2023-45881
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2023-45881
Title: GibbonEdu Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS. The imageAsLinks parameter must be set to Y to return HTML code. The filename attribute of the bodyfile1 parameter is reflected in the response.