Headline
PHPJabbers Taxi Booking 2.0 Cross Site Scripting
PHPJabbers Taxi Booking version 2.0 suffers from a cross site scripting vulnerability.
# Exploit Title: PHPJabbers Taxi Booking 2.0 - Reflected XSS# Exploit Author: CraCkEr# Date: 22/07/2023# Vendor: PHPJabbers# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/taxi-booking-script/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site# CVE: CVE-2023-4116## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka CryptoJob (Twitter) twitter.com/0x0CryptoJob## DescriptionThe attacker can send to victim a link containing a malicious URL in an email or instant messagecan perform a wide variety of actions, such as stealing the victim's session token or login credentialsPath: /index.phpGET parameter 'index' is vulnerable to RXSShttps://website/index.php?controller=pjFrontPublic&action=pjActionSearch&locale=1&index=[XSS][-] DoneRelated news
CVE-2023-4116
A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235963. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.