CVE-2023-4110
Published: 03 August 2023
Summary
CVE-2023-4110 is a low-severity Cross-site Scripting (CWE-79) vulnerability in Phpjabbers Availability Booking Calendar. Its CVSS base score is 3.5 (Low).
Operationally, ranked in the top 8.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability classified as cross-site scripting (CWE-79) affects PHP Jabbers Availability Booking Calendar version 5.0. It resides in an unspecified function of the file /index.php, where manipulation of the session_id argument permits injection of arbitrary scripts. The issue received a CVSS v3.1 score of 3.5 and was assigned VDB-235957 after the vendor was notified but did not respond.
The flaw can be triggered remotely by an authenticated user who supplies a crafted session_id value. Successful exploitation results in the execution of attacker-controlled script code within the context of other users' browsers, enabling limited impact such as data manipulation reflected in the application interface while leaving confidentiality and availability unaffected.
No vendor patch or official mitigation guidance has been published. Public references consist of disclosure entries on VulDB and a PacketStorm proof-of-concept archive; the EPSS score remains low with only minor fluctuation between its current value of 0.0666 and recorded peak of 0.0765.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-53996
Vulnerability details
A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument session_id leads to cross site scripting. The…
more
attack can be launched remotely. The identifier VDB-235957 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.