Exploits / Vulnerability Discovered : 2023-08-08 |
Type : webapps |
Platform : php
This exploit / vulnerability Phpjabbers vacation rental script 4.0 csrf is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: PHPJabbers Vacation Rental Script 4.0 - CSRF
# Date: 05/08/2023
# Exploit Author: Hasan Ali YILDIR
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/vacation-rental-script/
# Version: 4.0
# Tested on: Windows 10 Pro
## Description
The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials
Technical Detail / POC
==========================
1. Login Account
2. Go to Property Page (https://website/index.php?controller=pjAdminListings&action=pjActionUpdate)
3. Edit Any Property (https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=21)