PT-2025-7294 · Phpjabbers · Phpjabbers Car Park Booking System

Published 2025-02-20 · Updated 2025-06-05 · CVE-2023-51311

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPJabbers Car Park Booking System version 3.0

Description The issue is related to a CSV injection vulnerability that allows an attacker to execute remote code. This vulnerability exists due to insufficient input validation in the Languages section. Specifically, any parameters field in System Options used to construct the CSV file is affected.

Recommendations For PHPJabbers Car Park Booking System version 3.0, consider disabling the functionality that allows user input to be used in constructing CSV files until a patch is available. Restrict access to the System Options and Languages section to minimize the risk of exploitation. Avoid using any parameters field in System Options that is used to construct the CSV file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2023-51311

Affected Products

Phpjabbers Car Park Booking System

References · 10

• 🔥 https://packetstorm.news/files/id/176494 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-51311 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51311 · Vendor Advisory
• https://t.me/cvenotify/112331 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1892625157115539468 · Twitter Post
• http://packetstormsecurity.com/files/176494/PHPJabbers-Car-Park-Booking-System-3.0-CSV-Injection.html · Note
• https://twitter.com/CVEnew/status/1892583431311073696 · Twitter Post
• https://phpjabbers.com/car-park-booking/#sectionDemo · Note
• https://t.me/cvenotify/124833 · Telegram Post
• https://t.me/cvedetector/18547 · Telegram Post