Gibbon Installation Page Exposure Scanner

Gibbon is an open-source education management platform used by schools and institutions worldwide to manage student data, timetables, and assessments. System administrators and IT staff deploy Gibbon to streamline administrative workflows. The installer is a critical component for initial configuration, guiding users through database setup and admin account creation. Its accessibility is essential during deployment but becomes a security risk if left exposed post-installation.

Installation Page Exposure occurs when the Gibbon installer remains accessible after setup completion. This vulnerability arises from misconfigured web servers or failure to remove or restrict the install directory. Attackers can exploit this by accessing the installer page, potentially reinitializing the system or altering core settings. The lack of authentication on these pages makes them a prime target for unauthorized manipulation.

Technically, the vulnerability is present at the /install/ endpoint of the Gibbon application. The installer script does not enforce session checks or IP restrictions, allowing any unauthenticated user to load the page. By sending a GET request to this path, an attacker can trigger the setup wizard, which may expose database credentials or allow reconfiguration of admin accounts. The scanner checks for the presence of this endpoint and verifies if it returns a 200 OK status.

If exploited, an attacker could gain full control over the Gibbon instance, including access to sensitive student and staff data. They could modify system configurations, create unauthorized admin accounts, or inject malicious code. This could lead to data breaches, service disruption, and reputational damage for the institution. Immediate remediation is critical to prevent unauthorized access and maintain platform integrity.