PT-2025-7311 · Phpjabbers · Phpjabbers Cleaning Business

Published 2025-02-20 · Updated 2025-02-20 · CVE-2023-51331

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPJabbers Cleaning Business Software version 1.0

Description The issue exists due to insufficient input validation on the Languages section Labels any parameters field in System Options that is used to construct a CSV file, allowing an attacker to execute remote code. This is a result of a CSV Injection vulnerability.

Recommendations For PHPJabbers Cleaning Business Software version 1.0, as a temporary workaround, consider disabling the construction of CSV files from user-inputted data in the System Options until a patch is available. Restrict access to the Languages section Labels any parameters field to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-51331

Affected Products

Phpjabbers Cleaning Business

References · 8

• 🔥 https://packetstorm.news/files/id/176509 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-51331 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51331 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1892681465718042783 · Twitter Post
• https://phpjabbers.com/cleaning-business-software/#sectionDemo · Note
• http://packetstormsecurity.com/files/176509/PHPJabbers-Cleaning-Business-Software-1.0-CSV-Injection.html · Note
• https://twitter.com/CVEnew/status/1892616605143859675 · Twitter Post
• https://t.me/cvedetector/18573 · Telegram Post