PHPJabbers Car Rental 3.0 Cross Site Scripting

`# Exploit Title: PHPJabbers Car Rental v3.0 - Multiple Stored XSS  
# Date: 19/11/2023  
# Exploit Author: BugsBD Limited  
# Discover by: Rahad Chowdhury  
# Vendor Homepage: https://www.phpjabbers.com/  
# Software Link: https://www.phpjabbers.com/car-rental-script/  
# Version: v3.0  
# Tested on: Windows 10, Windows 11, Linux  
# CVE-2023-48836  
  
Descriptions:  
PHPJabbers Car Rental v3.0 is vulnerable to Multiple Stored Cross-Site  
Scripting. Multiple Stored XSS is a type of security vulnerability  
that occurs when an application or website allows an attacker to  
inject malicious scripts into the content that is permanently stored  
on the server. Unlike reflected XSS, where the malicious script is  
embedded in a URL and executed immediately, stored XSS involves the  
persistent storage of the malicious script on the target server,  
waiting for unsuspecting users to access the compromised content.  
  
Steps to Reproduce:  
1. Login your panel.  
2. Vulnerable parameters are "name, plugin_sms_api_key,  
plugin_sms_country_code, calendar_id, title, country name,  
customer_name".  
3. Go to System Menu then click SMS Settings.  
4. Then use any XSS Payload in "SMS API Key", "Default Country Code"  
input field and Save.  
5. You will see popup.  
  
  
## Reproduce:  
[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48836)  
`