PT-2025-7306 · Phpjabbers · Phpjabbers Shared Asset Booking System

Published 2025-02-20 · Updated 2025-02-20 · CVE-2023-51324

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPJabbers Shared Asset Booking System version 1.0

Description The issue is related to a CSV injection vulnerability that allows an attacker to execute remote code. This vulnerability exists due to insufficient input validation in the Languages section Labels any parameters field in System Options, which is used to construct the CSV file.

Recommendations For PHPJabbers Shared Asset Booking System version 1.0, consider disabling the functionality that allows user input in the Languages section Labels any parameters field in System Options until a patch is available. Restrict access to the System Options to minimize the risk of exploitation. Avoid using the parameters field in the affected section until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-51324

Affected Products

Phpjabbers Shared Asset Booking System

References · 7

• 🔥 https://packetstorm.news/files/id/176504 · Exploit
• https://osv.dev/vulnerability/CVE-2023-51324 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51324 · Security Note
• http://packetstormsecurity.com/files/176504/PHPJabbers-Shared-Asset-Booking-System-1.0-CSV-Injection.html · Note
• https://t.me/cvedetector/18569 · Telegram Post
• https://twitter.com/CVEnew/status/1892602681488769367 · Twitter Post
• https://phpjabbers.com/shared-asset-booking-system/#sectionDemo · Note