In Gibbon versions prior to v30.0.01, the Tracking/graphing module contains an authenticated SQL injection flaw. An attacker with Teacher or higher privileges can inject arbitrary SQL code, enabling unintended read or write operations against the underlying database. This is a classic input validation weakness classified as CWE-89.

Affected installations of Gibbon running any version earlier than 30.0.01. Exploitation requires authentication as a Teacher role or higher; no unauthenticated access is possible.

The CVSS score of 7 indicates high severity. EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no publicly confirmed exploits. Attackers must first gain or compromise a Teacher or higher account; within that privilege scope, the flaw allows direct manipulation of data, presenting a high risk if teacher accounts are weak or poorly protected.