PT-2023-25449 · Phpjabbers · Phpjabbers Cleaning Business

Published 2023-08-03 · Updated 2023-08-05 · CVE-2023-36139

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPJabbers Cleaning Business Software version 1.0

Description The issue allows remote attackers to take over accounts due to a lack of verification when changing an email address and/or password on the Profile Page.

Recommendations For PHPJabbers Cleaning Business Software version 1.0, consider temporarily restricting access to the Profile Page until a proper verification mechanism for email address and password changes is implemented. As a mitigation measure, restrict the ability to change email addresses and passwords to minimize the risk of account takeover. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2023-36139

Affected Products

Phpjabbers Cleaning Business

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-36139 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36139 · Vendor Advisory
• https://phpjabbers.com/cleaning-business-software · Note
• https://t.me/cvenotify/55836 · Telegram Post
• https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4 · Note