CVE-2023-4116

Deeper analysis

CVE-2023-4116 is a cross-site scripting flaw in PHP Jabbers Taxi Booking 2.0. The issue resides in an unspecified function of the /index.php file, where unsanitized input supplied to the index parameter is reflected back to the browser, enabling injection of arbitrary script code.

An unauthenticated remote attacker can exploit the flaw by sending a crafted URL to a victim user. Successful execution allows the attacker to perform actions in the context of the victim's browser session, such as modifying page content, though the vulnerability does not permit direct data exfiltration or server-side compromise.

Public references, including Packet Storm and Vuldb entries, document the issue but contain no vendor-supplied patches or mitigation guidance; the product maintainer did not respond to early disclosure notification. The associated EPSS score has remained in a narrow band near 0.23 with only modest fluctuation and no pronounced post-disclosure rise.