PT-2025-5838 · Phpjabbers · Phpjabbers Cinema Booking System

Ahrixia · Published 2025-02-06 · Updated 2025-06-24 · CVE-2024-57429

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: PHPJabbers Cinema Booking System version 2.0

Description: A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function allows remote attackers to escalate privileges by tricking an authenticated admin into submitting an unauthorized request.

Recommendations: For PHPJabbers Cinema Booking System version 2.0, consider disabling the pjActionUpdate function until a patch is available to prevent exploitation. Restrict access to this function to minimize the risk of privilege escalation. Avoid using this function in scenarios where an authenticated admin may be tricked into submitting unauthorized requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-57429

Affected Products

Phpjabbers Cinema Booking System

References · 8

• 🔥 https://github.com/ahrixia/CVE-2024-57429 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-57429 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57429 · Vendor Advisory
• https://phpjabbers.com/cinema-booking-system · Note
• https://t.me/cvenotify/126435 · Telegram Post
• https://t.me/cvedetector/17410 · Telegram Post
• https://twitter.com/CVEnew/status/1887544734333247540 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1887560216155197924 · Twitter Post