Multiple HTML Injection Vulnerabilities in Car Rental Script by PHPJabbers
CVE-2023-48837

5.4MEDIUM

Key Information:

Vendor
PHPjabbers
Status
Car Rental Script
Vendor
CVE Published:
7 December 2023

Summary

Car Rental Script 3.0 contains vulnerabilities that allow attackers to exploit multiple HTML injection points via manipulation of the SMS API Key or Default Country Code. This could lead to potential unauthorized actions being executed due to the inadequately sanitized user inputs. Ensuring appropriate validation and sanitization measures are in place is crucial to protect against such attacks.

References

https://www.phpjabbers.com/car-rental-script/
http://packetstormsecurity.com/files/176048

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.