PT-2023-25451 · Phpjabbers · Phpjabbers Cleaning Business

Published 2023-09-11 · Updated 2023-09-13 · CVE-2023-36140

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPJabbers Cleaning Business Software version 1.0

Description The issue concerns the lack of encryption on user passwords, allowing an attacker to gain access to all user accounts. This enables unauthorized access, potentially leading to data breaches or other malicious activities.

Recommendations For PHPJabbers Cleaning Business Software version 1.0, consider implementing password encryption to secure user accounts. As a temporary workaround, restrict access to sensitive areas of the software to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-36140

Affected Products

Phpjabbers Cleaning Business

References · 7

• 🔥 https://medium.com/@blakehodder/additional-vulnerabilities-in-php-jabbers-scripts-c6bbd89b24bb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-36140 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36140 · Vendor Advisory
• https://medium.com/%40blakehodder/additional-vulnerabilities-in-php-jabbers-scripts-c6bbd89b24bb · Note
• https://twitter.com/CVEnew/status/1701244663481372801 · Twitter Post
• https://phpjabbers.com/cleaning-business-software · Note
• https://twitter.com/VulmonFeeds/status/1701271660534333864 · Twitter Post