PT-2025-7287 · Phpjabbers · Phpjabbers Hotel Booking System

Publicado 2025-02-19 · Atualizado 2025-02-21 · CVE-2023-51302

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPJabbers Hotel Booking System version 4.0

Description The PHPJabbers Hotel Booking System is affected by a CSV injection vulnerability, allowing an attacker to execute remote code. This issue exists due to insufficient input validation in the Languages section. Specifically, any parameters field in System Options used to construct the CSV file is vulnerable.

Recommendations For PHPJabbers Hotel Booking System version 4.0, consider disabling any parameters field in System Options that is used to construct the CSV file until a patch is available. Restrict access to the Languages section to minimize the risk of exploitation. Avoid using any fields in System Options that could be used to inject malicious CSV data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-1236

Identificadores relacionados

CVE-2023-51302

Produtos afetados

Phpjabbers Hotel Booking System

Referências · 9

• 🔥 http://packetstormsecurity.com/files/176489/PHPJabbers-Hotel-Booking-System-4.0-CSV-Injection.html · Exploit
• https://twitter.com/VulmonFeeds/status/1892366592220045460 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1892313760142151766 · Publicação no Twitter
• https://phpjabbers.com/hotel-booking-system/#sectionDemo · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-51302 · Nota de Segurança
• https://twitter.com/cybercronai/status/1892809121277067529 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-51302 · Aviso do Fabricante
• https://t.me/cvenotify/111844 · Publicação no Telegram
• https://t.me/cvedetector/18484 · Publicação no Telegram