PT-2023-28717 · Phpjabbers · Phpjabbers Limo Booking

Minotauro2020 · Publicado 2023-10-12 · Atualizado 2023-10-18 · CVE-2023-43147

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPJabbers Limo Booking Software version 1.0

Description The issue allows for Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function. This can be achieved through the "index.php?controller=pjAdminUsers&action=pjActionCreate" URI.

Recommendations For PHPJabbers Limo Booking Software version 1.0, consider disabling the Add Users Function until a patch is available to prevent exploitation. Restrict access to the "index.php?controller=pjAdminUsers&action=pjActionCreate" URI to minimize the risk of CSRF attacks.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-43147

Produtos afetados

Phpjabbers Limo Booking

Referências · 5

• 🔥 https://github.com/MinoTauro2020/CVE-2023-43147 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-43147 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1712540172384894994 · Publicação no Twitter
• https://t.me/cibsecurity/72189 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-43147 · Aviso do Fabricante