A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts.
This issue was fixed in the versions specified in the affected products list.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Active
User action required
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 35
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Php_Jabbers Appointment_Scheduler
cpe:2.3:a:php_jabbers:appointment_scheduler:*:*:*:*:*:*:*:*
|
0
|
4.1
|
|
Php_Jabbers Bus_Reservation_System
cpe:2.3:a:php_jabbers:bus_reservation_system:*:*:*:*:*:*:*:*
|
0
|
2.1
|
|
Php_Jabbers Car_Park_Booking_System
cpe:2.3:a:php_jabbers:car_park_booking_system:*:*:*:*:*:*:*:*
|
0
|
4.1
|
|
Php_Jabbers Car_Rental_Script
cpe:2.3:a:php_jabbers:car_rental_script:*:*:*:*:*:*:*:*
|
0
|
4.1
|
|
Php_Jabbers Cinema_Booking_System
cpe:2.3:a:php_jabbers:cinema_booking_system:*:*:*:*:*:*:*:*
|
0
|
2.1
|
|
Php_Jabbers Event_Booking_Calendar
cpe:2.3:a:php_jabbers:event_booking_calendar:*:*:*:*:*:*:*:*
|
0
|
5.1
|
|
Php_Jabbers Event_Ticketing_System
cpe:2.3:a:php_jabbers:event_ticketing_system:*:*:*:*:*:*:*:*
|
0
|
2.1
|
|
Php_Jabbers Hotel_Booking_System
cpe:2.3:a:php_jabbers:hotel_booking_system:*:*:*:*:*:*:*:*
|
0
|
5.1
|
|
Php_Jabbers Cleaning_Business_Software
cpe:2.3:a:php_jabbers:cleaning_business_software:*:*:*:*:*:*:*:*
|
0
|
2.1
|
|
Php_Jabbers Equipment_Rental_Script
cpe:2.3:a:php_jabbers:equipment_rental_script:*:*:*:*:*:*:*:*
|
0
|
2.1
|
|
Php_Jabbers Food_Delivery_Script
cpe:2.3:a:php_jabbers:food_delivery_script:*:*:*:*:*:*:*:*
|
0
|
4.1
|
|
Php_Jabbers Member_Login_Script
cpe:2.3:a:php_jabbers:member_login_script:*:*:*:*:*:*:*:*
|
0
|
4.1
|
|
Php_Jabbers Member_Directory_Script
cpe:2.3:a:php_jabbers:member_directory_script:*:*:*:*:*:*:*:*
|
0
|
2.1
|
|
Php_Jabbers Availability_Calendar
cpe:2.3:a:php_jabbers:availability_calendar:*:*:*:*:*:*:*:*
|
0
|
6.1
|
|
Php_Jabbers Php_Event_Calendar
cpe:2.3:a:php_jabbers:php_event_calendar:*:*:*:*:*:*:*:*
|
0
|
4.1
|
|
Php_Jabbers Php_Newsletter_Script
cpe:2.3:a:php_jabbers:php_newsletter_script:*:*:*:*:*:*:*:*
|
0
|
5.1
|
|
Php_Jabbers Product_Comparison_Script
cpe:2.3:a:php_jabbers:product_comparison_script:*:*:*:*:*:*:*:*
|
0
|
2.1
|
|
Php_Jabbers Ticket_Support_Script
cpe:2.3:a:php_jabbers:ticket_support_script:*:*:*:*:*:*:*:*
|
0
|
4.1
|
|
Php_Jabbers Php_Shopping_Cart
cpe:2.3:a:php_jabbers:php_shopping_cart:*:*:*:*:*:*:*:*
|
0
|
6.0
|
|
Php_Jabbers Auto_Classifieds_Script
cpe:2.3:a:php_jabbers:auto_classifieds_script:*:*:*:*:*:*:*:*
|
0
|
4.1
|
|
Php_Jabbers Business_Directory_Script
cpe:2.3:a:php_jabbers:business_directory_script:*:*:*:*:*:*:*:*
|
0
|
4.1
|
|
Php_Jabbers Availability_Booking_Calendar
cpe:2.3:a:php_jabbers:availability_booking_calendar:*:*:*:*:*:*:*:*
|
0
|
6.1
|
|
Php_Jabbers Time_Slots_Booking_Calendar
cpe:2.3:a:php_jabbers:time_slots_booking_calendar:*:*:*:*:*:*:*:*
|
0
|
5.1
|
|
Php_Jabbers Restaurant_Booking_System
cpe:2.3:a:php_jabbers:restaurant_booking_system:*:*:*:*:*:*:*:*
|
0
|
4.1
|
|
Php_Jabbers Shuttle_Booking_Software
cpe:2.3:a:php_jabbers:shuttle_booking_software:*:*:*:*:*:*:*:*
|
0
|
3.1
|
|
Php_Jabbers Meeting_Room_Booking_System
cpe:2.3:a:php_jabbers:meeting_room_booking_system:*:*:*:*:*:*:*:*
|
0
|
2.1
|
|
Php_Jabbers Rental_Property_Booking_Calendar
cpe:2.3:a:php_jabbers:rental_property_booking_calendar:*:*:*:*:*:*:*:*
|
0
|
3.1
|
|
Php_Jabbers Service_Booking_Script
cpe:2.3:a:php_jabbers:service_booking_script:*:*:*:*:*:*:*:*
|
0
|
2.1
|
|
Php_Jabbers Limo_Booking_Software
cpe:2.3:a:php_jabbers:limo_booking_software:*:*:*:*:*:*:*:*
|
0
|
2.1
|
|
Php_Jabbers Taxi_Booking_Script
cpe:2.3:a:php_jabbers:taxi_booking_script:*:*:*:*:*:*:*:*
|
0
|
3.1
|
|
Php_Jabbers Job_Listing_Script
cpe:2.3:a:php_jabbers:job_listing_script:*:*:*:*:*:*:*:*
|
0
|
4.1
|
|
Php_Jabbers Property_Listing_Script
cpe:2.3:a:php_jabbers:property_listing_script:*:*:*:*:*:*:*:*
|
0
|
4.1
|
|
Php_Jabbers Travel_Tours_Script
cpe:2.3:a:php_jabbers:travel_tours_script:*:*:*:*:*:*:*:*
|
0
|
3.1
|
|
Php_Jabbers Vacation_Rental_Script
cpe:2.3:a:php_jabbers:vacation_rental_script:*:*:*:*:*:*:*:*
|
0
|
5.1
|
|
Php_Jabbers Yacht_Listing_Script
cpe:2.3:a:php_jabbers:yacht_listing_script:*:*:*:*:*:*:*:*
|
0
|
3.1
|