PT-2025-7283 · Phpjabbers · Phpjabbers Event Booking Calendar

Published 2025-02-19 · Updated 2025-02-20 · CVE-2023-51298

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPJabbers Event Booking Calendar version 4.0

Description The issue exists due to insufficient input validation on the Languages section Labels any parameters field in System Options that is used to construct a CSV file, allowing an attacker to execute remote code through CSV Injection.

Recommendations For PHPJabbers Event Booking Calendar version 4.0, as a temporary workaround, consider disabling the construction of CSV files from user-inputted data in the Languages section Labels any parameters field in System Options until a patch is available. Restrict access to the System Options to minimize the risk of exploitation. Avoid using the parameters field in the affected section until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2023-51298

Affected Products

Phpjabbers Event Booking Calendar

References · 8

• 🔥 http://packetstormsecurity.com/files/176487/PHPJabbers-Event-Booking-Calendar-4.0-CSV-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-51298 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51298 · Vendor Advisory
• https://t.me/cvedetector/18469 · Telegram Post
• https://phpjabbers.com/event-booking-calendar/#sectionDemo · Note
• https://twitter.com/CVEnew/status/1892300745879286253 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1892374269935427893 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1892464033162273043 · Twitter Post