what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

PHPJabbers Event Ticketing System 1.0 Cross Site Scripting / HTML Injection

PHPJabbers Event Ticketing System 1.0 Cross Site Scripting / HTML Injection
Posted Jan 11, 2024
Authored by Rahad Chowdhury, BugsBD Limited

PHPJabbers Event Ticketing System version 1.0 suffers from cross site scripting and html injection vulnerabilities.

tags | exploit, vulnerability, xss
advisories | CVE-2023-51303, CVE-2023-51306, CVE-2023-51337
SHA-256 | 2caf4aa999009c25ac7c26798df4e4a0ac8a097c8ef866861469f934e7b3bfca

PHPJabbers Event Ticketing System 1.0 Cross Site Scripting / HTML Injection

Change Mirror Download
# Exploit Title: PHPJabbers Event Ticketing System v1.0 - Multiple HTML Injection
# Date: 19/12/2023
# Exploit Author: BugsBD Limited
# Discover by: Rahad Chowdhury
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/event-ticketing-system/#sectionDemo
# Version: v1.0
# Tested on: Windows 10, Windows 11, Linux
# CVE-2023-51303

Descriptions:
PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple HTML
Injection. HTML injection, also known as HTML code injection or
cross-site scripting (XSS), is a web security vulnerability that
allows an attacker to inject malicious code into a web page that is
then viewed by other users. This can lead to various attacks, such as
stealing sensitive information, session hijacking, defacement of
websites, or delivering malware to users.

Parameters: "lid, name, plugin_sms_api_key, plugin_sms_country_code,
title, plugin_sms_api_key, title".

Steps to Reproduce:
1. Login your panel.
2. Go to System Menu then click SMS Settings.
3. Then use any HTML Tag in "SMS API Key", "Default Country Code"
input field and Save.
4. You will see HTML code working here.

## Reproduce:
[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51303)




# Exploit Title: PHPJabbers Event Ticketing System v1.0 - Multiple Stored XSS
# Date: 19/12/2023
# Exploit Author: BugsBD Limited
# Discover by: Rahad Chowdhury
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/event-ticketing-system/#sectionDemo
# Version: v1.0
# Tested on: Windows 10, Windows 11, Linux
# CVE-2023-51306

Descriptions:
PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple
Stored Cross-Site Scripting. Multiple Stored XSS is a type of security
vulnerability that occurs when an application or website allows an
attacker to inject malicious scripts into the content that is
permanently stored on the server.

Steps to Reproduce:
1. Login your panel.
2. Vulnerable parameters are "name, title".
3. Go to System Users then click Add User.
4. Then use any XSS Payload in "Name" input field and Save.
5. You will see xss popup.


## Reproduce:
[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51306)



# Exploit Title: PHPJabbers Event Ticketing System v1.0 - Reflected XSS
# Date: 19/12/2023
# Exploit Author: BugsBD Limited
# Discover by: Rahad Chowdhury
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/event-ticketing-system/#sectionDemo
# Version: v1.0
# Tested on: Windows 10, Windows 11, Linux
# CVE-2023-51337

Descriptions:
Reflected cross-site scripting (XSS) vulnerability exists in index
page "lid" parameter of PHPJabbers Event Ticketing System v1.0 that
allows attackers to execute arbitrary web scripts or HTML via a
crafted payload injected into the Website login page parameter.

Steps to Reproduce:
1. Visit main url
2. Now use XSS Payload in "lid" parameter.
3. You will see xss popup.


## Reproduce:
[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51337)
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close