PT-2023-28717 · Phpjabbers · Phpjabbers Limo Booking

Minotauro2020 · Published 2023-10-12 · Updated 2023-10-18 · CVE-2023-43147

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPJabbers Limo Booking Software version 1.0

Description The issue allows for Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function. This can be achieved through the "index.php?controller=pjAdminUsers&action=pjActionCreate" URI.

Recommendations For PHPJabbers Limo Booking Software version 1.0, consider disabling the Add Users Function until a patch is available to prevent exploitation. Restrict access to the "index.php?controller=pjAdminUsers&action=pjActionCreate" URI to minimize the risk of CSRF attacks.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-43147

Affected Products

Phpjabbers Limo Booking

References · 5

• 🔥 https://github.com/MinoTauro2020/CVE-2023-43147 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-43147 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43147 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1712540172384894994 · Twitter Post
• https://t.me/cibsecurity/72189 · Telegram Post