PT-2023-27619 · Phpjabbers · Phpjabbers Car Rental Script

Published 2023-08-28 · Updated 2023-08-29 · CVE-2023-40754

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPJabbers Car Rental Script version 3.0

Description The issue allows remote attackers to take over accounts due to a lack of verification when changing an email address and/or password on the Profile Page.

Recommendations For PHPJabbers Car Rental Script version 3.0, consider temporarily disabling the account modification feature on the Profile Page until a patch is available. Restrict access to the Profile Page to minimize the risk of exploitation. Avoid using the email address and password change functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2023-40754

Affected Products

Phpjabbers Car Rental Script

References · 8

• 🔥 https://medium.com/@mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-40754 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40754 · Vendor Advisory
• https://twitter.com/CVEnew/status/1696150330596069874 · Twitter Post
• https://phpjabbers.com/car-rental-script · Note
• https://t.me/cibsecurity/69279 · Telegram Post
• https://medium.com/%40mfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f · Note
• https://twitter.com/VulmonFeeds/status/1696172308040192452 · Twitter Post