CSRF in PHP Jabbers scripts
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.1, 2.1, 5.1, 6.1, 6.0, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- PHP Jabbers Appointment Scheduler
fixed in 4.1
- PHP Jabbers Bus Reservation System
fixed in 2.1
- PHP Jabbers Car Park Booking System
fixed in 4.1
- PHP Jabbers Car Rental Script
fixed in 4.1
- PHP Jabbers Cinema Booking System
fixed in 2.1
- PHP Jabbers Event Booking Calendar
fixed in 5.1
- PHP Jabbers Event Ticketing System
fixed in 2.1
- PHP Jabbers Hotel Booking System
fixed in 5.1
- PHP Jabbers Cleaning Business Software
fixed in 2.1
- PHP Jabbers Equipment Rental Script
fixed in 2.1
- PHP Jabbers Food Delivery Script
fixed in 4.1
- PHP Jabbers Member Login Script
fixed in 4.1
- PHP Jabbers Member Directory Script
fixed in 2.1
- PHP Jabbers Availability Calendar
fixed in 6.1
- PHP Jabbers PHP Event Calendar
fixed in 4.1
- PHP Jabbers PHP Newsletter Script
fixed in 5.1
- PHP Jabbers Product Comparison Script
fixed in 2.1
- PHP Jabbers Ticket Support Script
fixed in 4.1
- PHP Jabbers PHP Shopping Cart
fixed in 6.0
- PHP Jabbers Auto Classifieds Script
fixed in 4.1
- PHP Jabbers Business Directory Script
fixed in 4.1
- PHP Jabbers Availability Booking Calendar
fixed in 6.1
- PHP Jabbers Time Slots Booking Calendar
fixed in 5.1
- PHP Jabbers Restaurant Booking System
fixed in 4.1
- PHP Jabbers Shuttle Booking Software
fixed in 3.1
- PHP Jabbers Meeting Room Booking System
fixed in 2.1
- PHP Jabbers Rental Property Booking Calendar
fixed in 3.1
- PHP Jabbers Service Booking Script
fixed in 2.1
- PHP Jabbers Limo Booking Software
fixed in 2.1
- PHP Jabbers Taxi Booking Script
fixed in 3.1
- PHP Jabbers Job Listing Script
fixed in 4.1
- PHP Jabbers Property Listing Script
fixed in 4.1
- PHP Jabbers Travel Tours Script
fixed in 3.1
- PHP Jabbers Vacation Rental Script
fixed in 5.1
- PHP Jabbers Yacht Listing Script
fixed in 3.1