PT-2025-7303 · Phpjabbers · Phpjabbers Night Club Booking

Published 2025-02-20 · Updated 2025-02-21 · CVE-2023-51320

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPJabbers Night Club Booking Software version 1.0

Description The issue is related to a CSV injection vulnerability that allows an attacker to execute remote code. This vulnerability exists due to insufficient input validation in the Languages section. Specifically, it involves labels and any parameters field in System Options used to construct the CSV file, such as username or language id.

Recommendations For PHPJabbers Night Club Booking Software version 1.0, as a temporary workaround, consider disabling the construction of CSV files from user-inputted data in the System Options until a patch is available. Restrict access to the Languages section to minimize the risk of exploitation. Avoid using parameters that are used to construct the CSV file in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-51320

Affected Products

Phpjabbers Night Club Booking

References · 7

• 🔥 https://packetstorm.news/files/id/176501 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-51320 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51320 · Vendor Advisory
• https://t.me/cvenotify/112107 · Telegram Post
• http://packetstormsecurity.com/files/176501/PHPJabbers-Night-Club-Booking-Software-1.0-CSV-Injection.html · Note
• https://phpjabbers.com/night-club-booking-software/#sectionDemo · Note
• https://twitter.com/CVEnew/status/1892598434370355202 · Twitter Post