PT-2025-5839 · Phpjabbers · Phpjabbers Cinema Booking System

Ahrixia · Published 2025-02-06 · Updated 2025-06-24 · CVE-2024-57430

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: PHPJabbers Cinema Booking System version 2.0

Description: An SQL injection vulnerability in the pjActionGetUser function allows attackers to manipulate database queries via the column parameter. This can lead to unauthorized information disclosure, privilege escalation, or database manipulation.

Recommendations: To resolve the issue, update PHPJabbers Cinema Booking System to a version that fixes the SQL injection vulnerability in the pjActionGetUser function. As a temporary workaround, consider restricting access to the pjActionGetUser function to minimize the risk of exploitation. Additionally, avoid using the column parameter in the affected function until the issue is resolved.

Exploit

Fix

LPE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-57430

Affected Products

Phpjabbers Cinema Booking System

References · 8

• 🔥 https://github.com/ahrixia/CVE-2024-57430 · Exploit
• https://osv.dev/vulnerability/CVE-2024-57430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57430 · Security Note
• https://twitter.com/CVEnew/status/1887544735260094732 · Twitter Post
• https://phpjabbers.com/cinema-booking-system · Note
• https://t.me/cvenotify/126436 · Telegram Post
• https://t.me/cvedetector/17411 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1887562776018657337 · Twitter Post