Cross Site Scripting Vulnerability in PHPJabbers Fundraising Script
CVE-2023-40751

6.1MEDIUM

Key Information:

Vendor

PHPjabbers

Status
Fundraising Script
Vendor
CVE Published:
28 August 2023

What is CVE-2023-40751?

The PHPJabbers Fundraising Script version 1.0 has a vulnerability that allows attackers to execute arbitrary scripts in the context of a user's session. This occurs through improper validation of the 'action' parameter in index.php, enabling the injection of malicious scripts when users interact with the application. This XSS vulnerability can lead to cookie theft, session hijacking, and other serious security issues, necessitating immediate attention from users of this product.

References

https://www.phpjabbers.com/fundraising-script/
https://medium.com/%40mfortinsec/multiple-vulnerabilities...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.