{"vulnerability": "CVE-2023-45878", "sightings": [{"uuid": "e91afd60-521c-4365-adda-f796928463bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lppir3qqd22w", "content": "", "creation_timestamp": "2025-05-21T21:02:20.078137Z"}, {"uuid": "6f81d0d8-21b2-4895-9547-523d26e07014", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-45878.yaml", "content": "", "creation_timestamp": "2025-04-29T00:46:35.000000Z"}, {"uuid": "3babddc6-5773-4c10-80b6-de4b7c7af2dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3locaehl3we2k", "content": "", "creation_timestamp": "2025-05-03T21:02:16.460368Z"}, {"uuid": "a7f6e240-7026-479e-b92b-94b4a98e6d4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-07-16)", "content": "", "creation_timestamp": "2025-07-16T00:00:00.000000Z"}, {"uuid": "37fc1f57-214d-4b18-a762-ac6c64c3148c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-07-21)", "content": "", "creation_timestamp": "2025-07-21T00:00:00.000000Z"}, {"uuid": "61faadb3-136c-415f-a01e-985638bd7fb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-10-29)", "content": "", "creation_timestamp": "2025-10-29T00:00:00.000000Z"}, {"uuid": "21377f03-8138-4949-8bae-448070964634", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-07-29)", "content": "", "creation_timestamp": "2025-07-29T00:00:00.000000Z"}, {"uuid": "dd5b51d8-94f9-4dc0-8041-8bb9a23a08d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-10-17)", "content": "", "creation_timestamp": "2025-10-17T00:00:00.000000Z"}, {"uuid": "7a76cad2-3d02-48a5-b08c-bdf7d778a0dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-17)", "content": "", "creation_timestamp": "2026-03-17T00:00:00.000000Z"}, {"uuid": "f15c9a78-afb3-451c-abb6-ad56425a817f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-01)", "content": "", "creation_timestamp": "2026-04-01T00:00:00.000000Z"}, {"uuid": "f1e6414e-4671-4f8b-ad4b-cfeab45c56db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-19)", "content": "", "creation_timestamp": "2026-04-19T00:00:00.000000Z"}, {"uuid": "c68a3860-f3ba-4e28-816d-1dbbd74012d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/746", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-45878\n\ud83d\udd39 Description: GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).\n\ud83d\udccf Published: 2023-11-14T00:00:00\n\ud83d\udccf Modified: 2025-01-08T16:45:47.399Z\n\ud83d\udd17 References:\n1. https://herolab.usd.de/security-advisories/usd-2023-0025/", "creation_timestamp": "2025-01-08T17:16:45.000000Z"}, {"uuid": "0ea3b888-1689-44dc-9342-f15c14d1a387", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/27560", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aThis script chains and automates Arbitrary File Write to RCE on Gibbon LMS through CVE-2023-45878 exploitation.\nURL\uff1ahttps://github.com/0xyy66/CVE-2023-45878_to_RCE\n\n\u6807\u7b7e\uff1a#RCE", "creation_timestamp": "2025-03-30T21:38:00.000000Z"}, {"uuid": "7c53265b-de1b-4118-bfdf-215ce29fcbbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/32313", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aArbitrary File Write in Gibbon LMS for RCE (CVE-2023-45878)\nURL\uff1ahttps://github.com/ulricvbs/gibbonlms-filewrite_rce\n\n\u6807\u7b7e\uff1a#RCE", "creation_timestamp": "2025-04-16T20:55:29.000000Z"}, {"uuid": "7419bbdc-6b1a-4509-91ca-470a4fe9a2c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "published-proof-of-concept", "source": "Telegram/eVE5YmoRFUZV8c7TTGPUWrAfKBs48EKz-_YLWjtS9xYVJuE", "content": "", "creation_timestamp": "2025-03-30T23:00:06.000000Z"}, {"uuid": "2fd36018-1dde-4124-9e49-116ff794592a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "published-proof-of-concept", "source": "Telegram/Y6MqGtLM5ccvEmlRJO9-JfH9jytI_xcSqG1WwKJD5suL4M0", "content": "", "creation_timestamp": "2025-04-17T05:00:06.000000Z"}, {"uuid": "de5d2738-28bf-4665-baec-8894d03edf4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "published-proof-of-concept", "source": "Telegram/ThXju2ZMT_612yASJRrFQJIKnYK5F6XY7q6en3PVZ2DGB64", "content": "", "creation_timestamp": "2025-03-21T04:00:08.000000Z"}, {"uuid": "3879c132-72ce-4961-996f-5bf3fedeab39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "published-proof-of-concept", "source": "Telegram/gMA-tjO3u7r6v0DXDtEtTd2G2qr0DluN8PNDCBpeT15Ynng", "content": "", "creation_timestamp": "2025-03-20T16:00:08.000000Z"}, {"uuid": "705000d8-4434-47bb-b393-faddd1cef87e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-10)", "content": "", "creation_timestamp": "2026-05-10T00:00:00.000000Z"}, {"uuid": "a8e3c832-0927-4540-aa0f-dbdcfed47aaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "seen", "source": "https://t.me/bagl3y_notes/124", "content": "\ud83c\udd95 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \u0442\u0430\u0447\u043a\u0438 HTB (HackTheBox) \u043e\u0442 ippsec'a\n\n\u2049\ufe0f CVE-2023-45878 \u0432 Gibbon-LMS \u0434\u043b\u044f foothold'a \u27a1\ufe0f \u0431\u0440\u0443\u0442 \u0445\u044d\u0448\u0430 \u0438\u0437 \u0411\u0414, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e ssh \u0447\u0435\u0440\u0435\u0437 Kerberos \u27a1\ufe0f \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e $RECYCLE.BIN \u27a1\ufe0f SharpGPOAbuse \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f SYSTEM\n\n#\ufe0f\u20e3 \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Windows box - TheFrizz, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Medium    \n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\u2754 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430\n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-04T13:00:26.302532Z"}, {"uuid": "b1653119-e4cf-4ffd-9376-1a7ffe08e32b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "seen", "source": "https://t.me/bagl3y_notes/124", "content": "\ud83c\udd95 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \u0442\u0430\u0447\u043a\u0438 HTB (HackTheBox) \u043e\u0442 ippsec'a\n\n\u2049\ufe0f CVE-2023-45878 \u0432 Gibbon-LMS \u0434\u043b\u044f foothold'a \u27a1\ufe0f \u0431\u0440\u0443\u0442 \u0445\u044d\u0448\u0430 \u0438\u0437 \u0411\u0414, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e ssh \u0447\u0435\u0440\u0435\u0437 Kerberos \u27a1\ufe0f \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e $RECYCLE.BIN \u27a1\ufe0f SharpGPOAbuse \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f SYSTEM\n\n#\ufe0f\u20e3 \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Windows box - TheFrizz, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Medium    \n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\u2754 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430\n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-05T00:00:42.024852Z"}, {"uuid": "c375be33-9f49-440a-bb1d-2630f18c9526", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-27)", "content": "", "creation_timestamp": "2026-05-27T00:00:00.000000Z"}, {"uuid": "fab199e4-eff8-4f62-9180-b2fbf2372281", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-28)", "content": "", "creation_timestamp": "2026-05-28T00:00:00.000000Z"}, {"uuid": "64e55c40-24b2-4033-b641-afc52b7f365c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "published-proof-of-concept", "source": "https://t.me/bagl3y_notes/124", "content": "\ud83c\udd95 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \u0442\u0430\u0447\u043a\u0438 HTB (HackTheBox) \u043e\u0442 ippsec'a\n\n\u2049\ufe0f CVE-2023-45878 \u0432 Gibbon-LMS \u0434\u043b\u044f foothold'a \u27a1\ufe0f \u0431\u0440\u0443\u0442 \u0445\u044d\u0448\u0430 \u0438\u0437 \u0411\u0414, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e ssh \u0447\u0435\u0440\u0435\u0437 Kerberos \u27a1\ufe0f \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e $RECYCLE.BIN \u27a1\ufe0f SharpGPOAbuse \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f SYSTEM\n\n#\ufe0f\u20e3 \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Windows box - TheFrizz, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Medium    \n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\u2754 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430\n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-06T00:00:39.383073Z"}, {"uuid": "b6d26b00-c384-4e9e-9f33-8cd1a39ff84d", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/55cac773-a630-46fa-9077-9e8d2dfd2742", "content": "", "creation_timestamp": "2026-06-19T12:45:59.427631Z"}, {"uuid": "63d7dbf3-50f2-4513-831b-aeafa2255df6", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45878", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/14c4a8f4-69ad-4edc-8d5d-c86f852141b5", "content": "", "creation_timestamp": "2026-06-23T14:03:22.457128Z"}, {"uuid": "09709bea-35fc-4bf8-b04a-cfd5f6468cba", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2023-45878", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2b4ba6f6-6197-4455-a89e-b6e87874415f", "content": "", "creation_timestamp": "2026-06-30T09:23:51.869186Z"}]}