Security
Headlines
HeadlinesLatestCVEs

Headline

PHPJabbers Service Booking Script 1.0 Cross Site Scripting

PHPJabbers Service Booking Script version 1.0 suffers from a cross site scripting vulnerability.

Packet Storm
#sql#xss#vulnerability#web#windows#php#auth#ssh
# Exploit Title: PHPJabbers Service Booking Script 1.0 - Reflected XSS# Exploit Author: CraCkEr# Date: 21/07/2023# Vendor: PHPJabbers# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/service-booking-script/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site# CVE: CVE-2023-4113## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka  CryptoJob (Twitter) twitter.com/0x0CryptoJob## DescriptionThe attacker can send to victim a link containing a malicious URL in an email or instant messagecan perform a wide variety of actions, such as stealing the victim's session token or login credentialsPath: /index.phpGET parameter 'index' is vulnerable to RXSShttps://website/index.php?controller=pjFrontPublic&action=pjActionServices&locale=1&index=[XSS][-] Done

Related news

CVE-2023-4113

A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-235960. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Packet Storm: Latest News

Ping Identity PingIDM 7.5.0 Query Filter Injection