PT-2023-25444 · Phpjabbers · Phpjabbers Class Scheduling System

Published 2023-08-03 · Updated 2023-08-08 · CVE-2023-36134

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHP Jabbers Class Scheduling System version 1.0

Description The issue concerns a lack of verification when changing an email address and/or password on the Profile Page, allowing remote attackers to take over accounts.

Recommendations For PHP Jabbers Class Scheduling System version 1.0, consider implementing proper verification mechanisms for email address and password changes on the Profile Page to prevent unauthorized account takeovers. As a temporary workaround, restrict access to the Profile Page until a proper fix is implemented.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2023-36134

Affected Products

Phpjabbers Class Scheduling System

References · 6

• 🔥 https://medium.com/@bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-36134 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36134 · Vendor Advisory
• https://phpjabbers.com/class-scheduling-system · Note
• https://t.me/cibsecurity/67752 · Telegram Post
• https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4 · Note