CVE-2023-40751

MEDIUMNuclei

PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-40751 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting (XSS) via the "action" parameter of index.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 2, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMPHPJabbers Fundraising Script v1.0 - Cross-Site ScriptingCVSS 6.1

PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting (XSS) via the "action" parameter of index.php.

Impact

Unauthenticated attackers can inject malicious JavaScript through the action parameter in index.php to steal fundraising administrator credentials and manipulate donation campaigns.

Remediation

Update PHPJabbers Fundraising Script to a version newer than 1.0 that properly sanitizes the action parameter in index.php.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2023phpjabbersfundraisingxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:phpjabbers:fundraising_script:1.0:*:*:*:*:*:*:*
Shodan: html:"PHPJabbers"
FOFA: body="PHPJabbers"
https://medium.com/@tfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f https://nvd.nist.gov/vuln/detail/CVE-2023-40751

Source: ProjectDiscovery

References

4