Executive brief
Gibbon, an open-source school management platform, contains a security vulnerability in its tracking and graphing module. An attacker with teacher-level access or higher can manipulate database queries to read or modify sensitive school data. This could lead to unauthorized access to student records or the alteration of academic information.
Technical details
An authenticated SQL injection vulnerability exists in Gibbon versions prior to v30.0.01 within the `modules/Tracking/graphing.php` component. The root cause is the improper neutralization of user-supplied input in the `gibbonDepartmentIDs` and `gibbonPersonIDs` POST parameters, which are concatenated into SQL queries. An attacker with 'Teacher' or higher privileges can exploit this to execute arbitrary SQL commands, leading to unauthorized data exfiltration or modification. The vendor has released version v30.0.01 to address this issue by improving input validation and parameterization.
Affected products
- GibbonEdu Gibbon before v30.0.01
Timeline
- 2026-02-06: patched: Version v30.0.01 released
- 2026-05-07: disclosed: Detailed research blog published by Project Black
- 2026-05-09: advisory: CVE-2026-8207 published