PT-2025-5839 · Phpjabbers · Phpjabbers Cinema Booking System

Ahrixia · Publicado 2025-02-06 · Atualizado 2025-06-24 · CVE-2024-57430

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: PHPJabbers Cinema Booking System version 2.0

Description: An SQL injection vulnerability in the pjActionGetUser function allows attackers to manipulate database queries via the column parameter. This can lead to unauthorized information disclosure, privilege escalation, or database manipulation.

Recommendations: To resolve the issue, update PHPJabbers Cinema Booking System to a version that fixes the SQL injection vulnerability in the pjActionGetUser function. As a temporary workaround, consider restricting access to the pjActionGetUser function to minimize the risk of exploitation. Additionally, avoid using the column parameter in the affected function until the issue is resolved.

Exploit

Correção

LPE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2024-57430

Produtos afetados

Phpjabbers Cinema Booking System

Referências · 8

• 🔥 https://github.com/ahrixia/CVE-2024-57430 · Exploit
• https://twitter.com/CVEnew/status/1887544735260094732 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2024-57430 · Aviso do Fabricante
• https://phpjabbers.com/cinema-booking-system · Nota
• https://t.me/cvenotify/126436 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2024-57430 · Nota de Segurança
• https://t.me/cvedetector/17411 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1887562776018657337 · Publicação no Twitter