PT-2023-25524 · Phpjabbers · Phpjabbers Document Creator

Published 2023-08-10 · Updated 2023-08-11 · CVE-2023-36309

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPJabbers Document Creator version 1.0

Description There is a Cross Site Scripting (XSS) issue in the action parameter of "index.php" in PHPJabbers Document Creator. This allows for potential malicious script execution.

Recommendations For PHPJabbers Document Creator version 1.0, consider restricting access to the "index.php" file or validating and sanitizing the action parameter to prevent XSS attacks. As a temporary workaround, avoid using the action parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-36309

Affected Products

Phpjabbers Document Creator

References · 6

• 🔥 https://medium.com/@milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-36309 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36309 · Vendor Advisory
• https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4 · Note
• https://twitter.com/VulmonFeeds/status/1689709867290808320 · Twitter Post
• https://phpjabbers.com/document-creator · Note