CVE-2023-40750

MEDIUMNuclei

PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-40750 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Yacht Listing Script v1.0.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 2, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMPHPJabbers Yacht Listing Script v1.0 - Cross-Site ScriptingCVSS 6.1

There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Yacht Listing Script v1.0.

Impact

Unauthenticated attackers can inject malicious JavaScript through the action parameter in index.php to steal yacht listing administrator credentials and manipulate boat listings.

Remediation

Update PHPJabbers Yacht Listing Script to a version newer than 1.0 that properly sanitizes the action parameter in index.php.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2023phpjabbersyacht-listingxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:phpjabbers:yacht_listing_script:1.0:*:*:*:*:*:*:*
Shodan: html:"PHPJabbers"
FOFA: body="PHPJabbers"
https://medium.com/@tfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f https://nvd.nist.gov/vuln/detail/CVE-2023-40750

Source: ProjectDiscovery

References

4