CVE-2023-41538

MEDIUMNuclei

PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-41538 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 1, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMPHPJabbers PHP Forum Script 3.0 - Cross-Site ScriptingCVSS 6.1

PhpJabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.

Impact

Unauthenticated attackers can inject malicious JavaScript through the keyword parameter in search functionality, potentially stealing forum administrator session cookies and accessing sensitive forum discussions.

Remediation

Update PHPJabbers PHP Forum Script to a version newer than 3.0 that properly sanitizes the keyword parameter and encodes output in preview.php.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2023cvexssphpjabberjabberphpjabbersvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:phpjabbers:php_forum_script:3.0:*:*:*:*:*:*:*
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/PHP-Forum-Script-3.0 https://nvd.nist.gov/vuln/detail/CVE-2023-41538 https://github.com/2lambda123/Windows10Exploits https://github.com/codeb0ss/CVE-2023-41538-PoC https://github.com/nomi-sec/PoC-in-GitHub

Source: ProjectDiscovery

References

2