PT-2020-6157 · Phpjabbers · Phpjabbers Appointment Scheduler

Andrea Intilangelo · Published 2020-12-15 · Updated 2022-08-06 · CVE-2020-35416

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHPJabbers Appointment Scheduler version 2.3

Description The issue is related to cross-site scripting (XSS) vulnerabilities in the admin login webpage of the PHPJabbers Appointment Scheduler. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML, potentially leading to security breaches. The vulnerable webpage is index.php, and the issue is associated with different request parameters.

Recommendations For PHPJabbers Appointment Scheduler version 2.3, consider disabling access to the index.php admin login webpage until a patch is available. Restrict the use of request parameters in the admin login webpage to minimize the risk of exploitation. Avoid using the vulnerable webpage for administrative tasks until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-03195

CVE-2020-35416

Affected Products

Phpjabbers Appointment Scheduler

References · 9

• 🔥 https://exploit-db.com/exploits/49281 · Exploit
• 🔥 http://packetstormsecurity.com/files/160600/PHPJabbers-Appointment-Scheduler-2.3-Cross-Site-Scripting.html · Exploit
• 🔥 http://packetstormsecurity.com/files/160502/PHPJabbers-Appointment-Scheduler-2.3-Cross-Site-Scripting.html · Exploit
• https://bdu.fstec.ru/vul/2021-03195 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-35416 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35416 · Vendor Advisory
• https://t.me/cibsecurity/20886 · Telegram Post
• https://t.me/cvenotify/7285 · Telegram Post
• ttp://packetstormsecurity.com/files/160502/PHPJabbers-Appointment-Scheduler-2.3-Cross-Site-Scripting.html · Note