CVE-2024-24724

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1336

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
gibbonedu	gibbon	<= 26.0.00

References

https://gibbonedu.org/download/Product
https://packetstormsecurity.com/files/177857Exploit
https://gibbonedu.org/download/Product
https://packetstormsecurity.com/files/177857Exploit

Timeline

Published: Apr 3, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-247258.8Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the mod CVE-2024-24735.3The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due t CVE-2024-247318.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentic CVE-2024-247367.5The POP3 service in YahooPOPs (aka YPOPs!) 1.6 allows a remote denial of service (reboot) via a long string to TCP port 110, a related issue CVE-2024-247396.3SAP Bank Account Management (BAM) allows an authenticated user with restricted access to use functions which can result in escalation of pri CVE-2024-24746.4The Standout Color Boxes and Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'color-button' short CVE-2024-247405.3SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94 CVE-2024-247414.3SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authori CVE-2024-247424.1SAP CRM WebClient UI - version S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WE CVE-2024-247437.5SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a craf CVE-2024-247467.5Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. Specially crafted GATT operation can cause infinite CVE-2024-247478.8MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for