PT-2023-25447 · Phpjabbers · Phpjabbers Class Scheduling System

CVE-2023-36137 · Publicado 2023-08-03 · Atualizado 2023-08-08

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPJabbers Class Scheduling System version 1.0

Description The issue is related to a Cross Site Scripting (XSS) vulnerability. This vulnerability is found in the theme parameter of the "preview.php" file.

Recommendations For PHPJabbers Class Scheduling System version 1.0, avoid using the theme parameter in the "preview.php" file until a fix is available. As a temporary workaround, consider restricting access to the "preview.php" file to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-36137

Produtos afetados

Phpjabbers Class Scheduling System

Referências · 5

• https://phpjabbers.com/class-scheduling-system · Nota
• https://t.me/cibsecurity/67735 · Publicação no Telegram
• https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4 · Nota
• https://osv.dev/vulnerability/CVE-2023-36137 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-36137 · Nota de Segurança