Threat database

PHPJabbers Simple CMS 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through section name parameters. Attackers can create sections with embedded JavaScript payloads that will execute when administrators view the sections, potentially enabling client-side code execution.

EPSS 0.3%VulnerabilityPHPJabbersGermanyUnited Kingdom+8

PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attackers can inject crafted SQL payloads through the 'column' parameter in the index.php endpoint to potentially extract or modify database information.

EPSS 0.6%VulnerabilityPHPJabbersGermanyUnited Kingdom+4

CVE-2023-53878 is a high-severity HTTP request smuggling vulnerability in Phpjabbers Member Login Script version 3.3. It arises from inconsistent parsing of the Content-Length header, allowing attackers to craft malicious POST requests that desynchronize client-server HTTP request handling. This can enable attackers to bypass server-side request processing controls, potentially leading to unauthorized actions or data exposure. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently reported in the wild, the vulnerability's nature and CVSS score of 7.3 indicate a significant risk. European organizations using this script, especially those in sectors relying on web-based member authentication, could face targeted attacks. Mitigation involves applying patches once available, implementing strict HTTP header validation, and deploying web application firewalls with request smuggling detection capabilities. Countries with higher adoption of Phpjabbers products and critical web infrastructure are at greater risk.

EPSS 0.4%VulnerabilityPhpjabbersGermanyFrance+6

CVE-2023-53877 is a critical SQL injection vulnerability in Phpjabbers Bus Reservation System version 1.1. It arises from improper neutralization of special elements in the 'pickup_id' parameter, allowing attackers to manipulate backend SQL queries. Exploitation techniques include boolean-based, error-based, and time-based blind SQL injection, enabling attackers to extract sensitive database information without authentication or user interaction. The vulnerability has a CVSS 4.0 score of 9.3, indicating high impact on confidentiality and integrity with no required privileges. European organizations using this system risk data breaches, potentially exposing customer and operational data. Mitigation requires immediate patching or applying input validation and parameterized queries. Countries with significant transport and tourism sectors using this software are at higher risk.

EPSS 0.4%VulnerabilityPhpjabbersGermanyFrance+8

A weakness has been identified in PHPJabbers Restaurant Menu Maker up to 1.1. Affected by this issue is some unknown functionality of the file /preview.php. This manipulation of the argument theme causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

EPSS 0.4%VulnerabilityPHPJabbersGermanyFrance+8