CVE-2024-24725

What it actually does

CVE-2024-24725 is an authenticated PHP object deserialization vulnerability in Gibbon through version 26.0.00. The vulnerable code path accepts attacker-controlled input in the columnOrder POST parameter on the System Admin external assessment import workflow and processes it as serialized PHP data. If a usable gadget chain is present in the application or its dependencies, a remote authenticated attacker can cause unintended object instantiation and magic-method execution, potentially leading to arbitrary code execution, file write/delete, sensitive data access, or application compromise. Even where full code execution is not achievable, the flaw can still enable application logic abuse, denial of service, or unauthorized manipulation of import behavior.

Why it matters to the business

Successful exploitation can allow a valid low-privileged or compromised account to take over the application, access student/staff records and administrative data, alter assessment or configuration data, and use the server as a foothold for broader compromise. The risk is elevated because exploit maturity is reported as weaponized and the EPSS score is high at 0.5132, indicating meaningful likelihood of exploitation in the wild despite the issue not currently appearing in CISA KEV. The provided affected package list references AlmaLinux xorg-x11-server packages rather than Gibbon, so asset owners should verify advisory-to-product mapping before relying only on package inventory results.

How an attack unfolds

An attacker first obtains valid Gibbon credentials, either through phishing, password reuse, credential stuffing, or by abusing an existing low-privileged account. The attacker then accesses the System Admin import workflow endpoint at modules/System%20Admin/import_run.php with type=externalAssessment and step=4. In the POST body, the attacker places a crafted serialized PHP payload in the columnOrder parameter. When the server processes the request, the application deserializes attacker-supplied data. If the runtime contains a compatible PHP object gadget chain, deserialization invokes magic methods such as __wakeup or __destruct and executes attacker-controlled behavior. Depending on available gadgets and server permissions, the attacker may write a web shell, execute commands, read application configuration files, dump database credentials, modify records, create administrator accounts, or pivot further into the hosting environment.

How to fix it

Upgrade Gibbon to a version newer than 26.0.00 that contains the vendor fix for this deserialization issue. If immediate upgrade is not possible, restrict access to the System Admin import workflow to trusted administrators only, disable or firewall access to the vulnerable import endpoint where operationally feasible, enforce strong MFA for administrative users, and monitor/block serialized PHP payload patterns in the columnOrder parameter at the WAF or reverse proxy. Review application dependencies for known PHP gadget chains and remove unnecessary libraries. The input also lists AlmaLinux 8 xorg-x11-server package fixes; if those packages are in scope for a separate advisory, update to xorg-x11-server-devel/source/Xdmx/Xephyr/Xnest/Xorg/Xvfb/common 1.20.11-5.el8 and xorg-x11-server-Xwayland 21.1.3-2.el8, but verify this mapping because it does not match the Gibbon vulnerability description.

How to confirm the fix worked

Confirm the deployed Gibbon version is later than 26.0.00 or that the vendor patch for this issue is present. Attempting exploitation in production is not recommended; instead, verify that requests containing serialized PHP object markers in columnOrder are rejected, sanitized, or no longer deserialized. Review web server, application, and WAF logs to confirm that access to modules/System%20Admin/import_run.php with type=externalAssessment and step=4 is limited to expected administrative users. Validate that least-privilege permissions prevent non-administrative users from reaching the external assessment import path. For package-based validation where the AlmaLinux xorg entries are relevant, confirm installed RPM versions meet or exceed the fixed versions listed in the advisory.

Typical attack path

1. Acquire valid credentials for a Gibbon account with access to the external assessment import workflow or a role that can reach the vulnerable endpoint.
2. Send a POST request to /modules/System%20Admin/import_run.php&type=externalAssessment&step=4 or the equivalent routed application path.
3. Place a crafted PHP serialized object payload in the columnOrder parameter.
4. Trigger server-side PHP deserialization during import processing.
5. Use a gadget chain in Gibbon or installed PHP dependencies to execute code, write files, alter data, or disclose sensitive information.
6. Establish persistence, such as creating an administrative account, deploying a web shell, or modifying application configuration.
7. Access, exfiltrate, or manipulate sensitive school, staff, assessment, or operational data.

How to detect it

Look for authenticated POST requests to the Gibbon external assessment import endpoint with suspicious serialized PHP content in the columnOrder parameter. Prioritize web server access logs, reverse proxy logs, WAF events, PHP error logs, Gibbon application logs, authentication logs, file integrity monitoring, and endpoint process telemetry. Suspicious patterns include requests to modules/System%20Admin/import_run.php with type=externalAssessment and step=4, columnOrder values containing PHP serialization tokens such as O:, C:, a:, s:, __wakeup, __destruct, or url-encoded equivalents, and responses followed by creation or modification of PHP files in web-accessible directories. Investigate successful logins from unusual IP addresses followed by access to the vulnerable endpoint. On hosts, look for unexpected child processes spawned by the web server or PHP runtime, such as sh, bash, curl, wget, python, perl, php -r, or nc, and for outbound connections shortly after suspicious POST requests. Because the vulnerability is authenticated, correlate endpoint hits with user IDs, session IDs, source IPs, user agents, and privilege changes such as new administrator accounts or modified permissions.

• /modules/System%20Admin/import_run.php&type=externalAssessment&step=4
• modules/System%20Admin/import_run.php
• type=externalAssessment
• step=4
• columnOrder=O:
• columnOrder=O%3A
• columnOrder=C:
• columnOrder=C%3A
• columnOrder=a:
• columnOrder=a%3A
• __wakeup
• __destruct
• __toString
• phpggc
• POST /modules/System%20Admin/import_run.php
• columnOrder=
• O%3A%22
• C%3A%22
• s%3A
• a%3A%7B
• ;i:
• ;s:
• /uploads/*.php
• /modules/*.php
• /themes/*.php
• php -r
• www-data sh
• apache sh
• nginx sh
• curl http
• wget http

What your security team should do

• Treat this as high priority because weaponized exploitation is reported and EPSS is high, even though it is not currently in CISA KEV.
• Identify all internet-facing and internal Gibbon deployments and determine whether any are running version 26.0.00 or earlier.
• Upgrade affected Gibbon instances to a fixed release newer than 26.0.00 as soon as possible.
• Restrict the vulnerable import endpoint to trusted administrative users and protected networks until patching is complete.
• Enable or tune WAF rules to flag PHP serialized object payloads in POST bodies, especially in the columnOrder parameter.
• Review authentication logs for unusual successful logins preceding access to the System Admin import workflow.
• Search for evidence of web shells, unexpected PHP files, modified application files, new administrator accounts, and suspicious outbound connections.
• Rotate application, database, and administrative credentials if exploitation is suspected.
• Verify the product/package mapping in vulnerability management tooling because the supplied affected package list appears inconsistent with the described Gibbon issue.