PT-2025-7316 · Phpjabbers · Phpjabbers Meeting Room Booking System

Published 2025-02-20 · Updated 2025-02-21 · CVE-2023-51336

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPJabbers Meeting Room Booking System version 1.0

Description The issue is related to a CSV Injection vulnerability that allows an attacker to execute remote code. This vulnerability exists due to insufficient input validation on the Languages section Labels any parameters field in System Options, which is used to construct a CSV file.

Recommendations For PHPJabbers Meeting Room Booking System version 1.0, consider disabling the Languages section Labels any parameters field in System Options to minimize the risk of exploitation until a patch is available. Restrict access to the System Options module to prevent attackers from constructing malicious CSV files. Avoid using the parameters field in the affected section until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2023-51336

Affected Products

Phpjabbers Meeting Room Booking System

References · 10

• 🔥 https://packetstorm.news/files/id/176518 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-51336 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51336 · Vendor Advisory
• https://t.me/cvedetector/18579 · Telegram Post
• https://twitter.com/CVEnew/status/1892640036505391262 · Twitter Post
• https://t.me/cvenotify/111927 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1892703162286456844 · Twitter Post
• http://packetstormsecurity.com/files/176518/PHPJabbers-Meeting-Room-Booking-System-1.0-CSV-Injection.html · Note
• https://t.me/cvenotify/112121 · Telegram Post
• https://phpjabbers.com/meeting-room-booking-system/#sectionDemo · Note