Headline
PHPJabbers Night Club Booking 1.0 Cross Site Scripting
PHPJabbers Night Club Booking version 1.0 suffers from a cross site scripting vulnerability.
# Exploit Title: PHPJabbers Night Club Booking 1.0 - Reflected XSS# Exploit Author: CraCkEr# Date: 21/07/2023# Vendor: PHPJabbers# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/night-club-booking-software/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site# CVE: CVE-2023-4114## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka CryptoJob (Twitter) twitter.com/0x0CryptoJob## DescriptionThe attacker can send to victim a link containing a malicious URL in an email or instant messagecan perform a wide variety of actions, such as stealing the victim's session token or login credentialsPath: /index.phpGET parameter 'index' is vulnerable to RXSShttps://website/index.php?controller=pjFront&action=pjActionSearch&session_id=&locale=1&index=[XSS]&date=[-] DoneRelated news
CVE-2023-4114
A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235961 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.